# Recovery Authentication Codes

DevFeed: [Recovery Authentication Codes](<https://devfeed.tech/articles/recovery-authentication-codes-31733.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2025/10/recovery-codes>)

Author: Ricardo Martin Camarero

Published: 2025-10-20T00:00:00Z

Content type: tutorial

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [WebAuthn](<https://devfeed.tech/topics/webauthn.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [idm](<https://devfeed.tech/tags/idm.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [otp](<https://devfeed.tech/tags/otp.md>), [passwords](<https://devfeed.tech/tags/passwords.md>), [recovery](<https://devfeed.tech/tags/recovery.md>), [saml](<https://devfeed.tech/tags/saml.md>), [sso](<https://devfeed.tech/tags/sso.md>)

## AI overview

This Keycloak article explains recovery authentication codes, a supported feature since version 26.3.0. It describes them as twelve sequential, one-time passwords that provide a backup second-factor method when an OTP or WebAuthn device is unavailable, and outlines how administrators enable and require them.

## Source excerpt

Recovery Codes are a supported authentication method in Keycloak since version 26.3.0. At that time, the new feature was not properly presented in this blog, but this new entry tries to address that oversight. If you prefer watching a video instead of reading this blog, Niko Köbler published Keycloak Recovery Authentication Codes in youtube. Although the video is two years old, when the feature was in preview, it still stands for almost everything and it is very recommendable. This entry updates the recovery codes status when the feature is finally supported. What are Recovery authentication codes? Recovery codes are a Second Factor Authentication (2FA) method which can be used as a backup option to avoid losing access to your account. Therefore, they can be configured or enabled in the authentication flow to give another chance to login in case the OTP or WebAuthn device is unavailable (for example your phone or yubikey are broken or lost). Technically the recovery codes are twelve sequential one-time passwords auto-generated by Keycloak. The authentication process asks the user for the next generated code in order. When that code is introduced, it is removed and the following code will be required in the subsequent login. Enable recovery codes for authentication The default browser flow already contains recovery codes as a 2FA sub-step, but the authenticator is disabled by default. You just need to enable it to make it available for the login. In the administration console, Authentication -> Flows, select the browser flow. Under the step Browser - Conditional 2FA, OTP Form is set to Alternative, but Recovery Authentication Code Form is Disabled. Change the latter to Alternative too. With this configuration, both alternative methods are available to login. Recovery codes can be integrated in more complex authentication flows if needed. Setup recovery codes for the final user The administrator can force any account to setup the recovery codes credentials assigning th