Auth providers now opt in to multi-factor authentication
1 min read
As of Home Assistant Core 2026.11, a login flow only asks for a second factor when it extends the new MfaLoginFlow. The auth manager no longer adds the MFA steps to every provider, and AuthProvider.support_mfa is removed.
Only relevant if your custom integration patches in its own auth provider.
Custom auth providers are not supported.
If you change nothing, your provider silently stops asking for a second factor, even if it never overrode support_mfa.
To ask for an enabled second factor, extend MfaLoginFlow. After validating the first factor, return await self.async_finish(flow_result) instead of calling self.async_create_entry(data=flow_result) directly, which bypasses the MFA check. If you override async_finish, return await super().async_finish(flow_result) so the MFA check still runs.
For example, change your login flow's base class:
from homeassistant.auth.providers import MfaLoginFlow
class MyLoginFlow(MfaLoginFlow[MyAuthProvider]):
...If your provider overrides support_mfa, remove the property. If it returned True, extend MfaLoginFlow as shown above, or your provider stops asking for a second factor. If it returned False, keep extending LoginFlow.
