What causes "Two factor authentication is not enabled" in RocketChat/Rocket.Chat?

Enable Accounts_TwoFactorAuthentication_Enabled (admin > Settings > Accounts > Two Factor Authentication) before resetting other users' TOTP.

RocketChat/Rocket.Chat · error · Meteor.Error

error-two-factor-not-enabled

error-two-factor-not-enabled

Error message

Two factor authentication is not enabled

What it means

Thrown by POST users.resetTOTP when the target path is taken (other user) but the global setting Accounts_TwoFactorAuthentication_Enabled is off. Resetting another user's TOTP is meaningless when 2FA is disabled server-wide, so the route refuses even if the caller is otherwise permissioned.

Source

Thrown at apps/meteor/server/api/v1/users.ts:1805

					username: { type: 'string' },
					user: { type: 'string' },
				},
				additionalProperties: false,
			}),
			response: {
				200: voidSuccessResponse,
				400: validateBadRequestErrorResponse,
				401: validateUnauthorizedErrorResponse,
			},
		},
		async function action() {
			if ('userId' in this.bodyParams || 'username' in this.bodyParams || 'user' in this.bodyParams) {
				if (!(await hasPermissionAsync(this.user, 'edit-other-user-totp'))) {
					throw new Meteor.Error('error-not-allowed', 'Not allowed');
				}

				if (!settings.get('Accounts_TwoFactorAuthentication_Enabled')) {
					throw new Meteor.Error('error-two-factor-not-enabled', 'Two factor authentication is not enabled');
				}

				const user = await getUserFromParams(this.bodyParams);
				if (!user) {
					throw new Meteor.Error('error-invalid-user-id', 'Invalid user id');
				}

				await resetTOTP(user._id, true);

				return API.v1.success();
			}
			await resetTOTP(this.userId, false);
			return API.v1.success();
		},
	);

API.v1
	.get(

View on GitHub (pinned to f9d3ec372b)

Solutions

Enable Accounts_TwoFactorAuthentication_Enabled (admin > Settings > Accounts > Two Factor Authentication) before resetting other users' TOTP.
If 2FA is intentionally off, do not call resetTOTP for others; no TOTP exists to reset.
Surface the setting state in the admin UI next to the reset action so the precondition is visible.

Example fix

// before - 2FA setting off
POST('/api/v1/users.resetTOTP', { userId: target })  // -> error-two-factor-not-enabled

// after
await Settings.set('Accounts_TwoFactorAuthentication_Enabled', true)
POST('/api/v1/users.resetTOTP', { userId: target })

Defensive patterns

Strategy: validation

Validate before calling

const twoFactorEnabled = await getSetting('Accounts_TwoFactorAuthentication_Enabled');
if (!twoFactorEnabled) {
  throw new ClientError('config','Enable Accounts_TwoFactorAuthentication_Enabled first');
}

Type guard

function twoFactorEnabledFor(value) { return value === true; }

Try / catch

try { await POST('/api/v1/users.resetTOTP', { userId }); }
catch (e) {
  if (e?.error === 'error-two-factor-not-enabled') { surface('2FA is disabled server-wide'); return; }
  throw e;
}

Prevention

Check the public 2FA setting before offering reset-TOTP in the UI.
Re-enable 2FA after migrations/imports.
Document that other-user TOTP reset requires the global setting on.

When it happens

Trigger: An admin resets another user's TOTP via the API while the instance-wide 2FA setting is disabled. The setting may have been turned off for maintenance or never enabled.

Common situations: 2FA disabled during a migration/import and not re-enabled. A new admin resets TOTP not realizing 2FA is off cluster-wide.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/4faeb069dffd278d. Report an issue: GitHub.