# 2fa requirement for manual trigger of a pipeline

**URL:** <https://forum.buildkite.community/t/2fa-requirement-for-manual-trigger-of-a-pipeline/1198>\
**Category:** Features Requests\
**Created:** [August 21, 2020, 3:22am UTC](https://forum.buildkite.community/t/2fa-requirement-for-manual-trigger-of-a-pipeline/1198 "2020-08-21T03:22:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pme](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/pme/32/711_2.png) [@pme](https://forum.buildkite.community/u/pme)\
**Post date:** [August 21, 2020, 3:22am UTC](https://forum.buildkite.community/t/2fa-requirement-for-manual-trigger-of-a-pipeline/1198/1 "2020-08-21T03:22:19Z")

</div>

This is a “companion to” [force 2FA for user in an organization](https://forum.buildkite.community/t/force-2fa-for-user-in-an-organization/259), as it is hard to implement.

I’d like to see an option for pipelines which lets us require 2fa to trigger a manual build.

Here’s the typical scenario:  
I’ve created a pipeline to deploy a new version of out website, which I’m letting our admins do, but I want to be sure that their laptops haven’t been compromised, so I’d like to make sure they used 2fa.

I know I can roll that myself using the graphql api (thanks [Rose](https://forum.buildkite.community/u/rose/summary) for the pointer) and check if the user has 2fa configured, but that is a bit convoluted.

Cheers,  
/Martin

---

<div class="post-metadata">

**Author:** ![sj26](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/sj26/32/17_2.png) [@sj26](https://forum.buildkite.community/u/sj26)\
**Post date:** [August 21, 2020, 5:44am UTC](https://forum.buildkite.community/t/2fa-requirement-for-manual-trigger-of-a-pipeline/1198/2 "2020-08-21T05:44:23Z")

</div>

Hi Martin!

Thanks for the suggestion.

It sounds to me like the “right way” might be to enforce 2FA at an organization level, which you’ve seen is already requested here, and which I think we’re planning to do at some point.

> require 2fa to trigger a manual build?

This is really interesting, but I’m not sure how to do it. As in, you can only use the _New Build_ button if you have 2fa set up? Or you have recently authenticated?

What about builds created through the APIs or webhooks, are they considered out of scope? i.e. is this best effort?

---

<div class="post-metadata">

**Author:** ![pme](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/pme/32/711_2.png) [@pme](https://forum.buildkite.community/u/pme)\
**Post date:** [August 21, 2020, 2:49pm UTC](https://forum.buildkite.community/t/2fa-requirement-for-manual-trigger-of-a-pipeline/1198/3 "2020-08-21T14:49:02Z")

</div>

Correct. APIs and webhooks are out of scope, but it would be nice if you tracked if the API key was created by a user with 2fa enabled, so you avoid privilege escalation.

---

<div class="post-metadata">

**Author:** ![sj26](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/sj26/32/17_2.png) [@sj26](https://forum.buildkite.community/u/sj26)\
**Post date:** [August 24, 2020, 12:51am UTC](https://forum.buildkite.community/t/2fa-requirement-for-manual-trigger-of-a-pipeline/1198/4 "2020-08-24T00:51:57Z")

</div>

> … would be nice if you tracked if the API key was created by a user with 2fa enabled …

This is a nice suggestion — if we add the ability to restrict organization membership to only users with 2fa enabled then we should probably only allow tokens created or confirmed with 2fa to access the organization, too. I’ll make sure this gets fed into our work on 2fa enforcement.