Skip to main content

​
Why Add Credentials

Credentials let assessments access authenticated areas that are not visible to public crawling. Credentials and login instructions are used together:
  • credentials provide what to enter
  • login instructions provide where and how agents should log in

​
Credential Types

MindFort supports four credential types. Each targets a different authentication flow your application may use.
TypeAuth Flow
Application LoginUsername & password
Authenticator 2FAUsername, password & TOTP code
SMS MFAUsername, password & SMS code
SMS LoginPhone number & SMS code only

​
Application Login

Standard username and password authentication.
FieldRequired
Credential NameYes
UsernameYes
PasswordYes
RoleYes (default: user)
DescriptionNo
Setup:
  1. Open Target Inventory and select a target.
  2. Click Add Credential and choose Username & Password.
  3. Enter the username and password for the test account.
  4. Select the appropriate role and save.

​
Authenticator 2FA

Username and password authentication with a TOTP-based second factor. MindFort generates time-based codes automatically during assessments using the secret you provide.
FieldRequired
Credential NameYes
UsernameYes
PasswordYes
TOTP SecretYes
RoleYes (default: user)
DescriptionNo
The TOTP secret is the base32-encoded string shown when you set up an authenticator app (e.g. JBSWY3DPEHPK3PXP). You can usually find this during the authenticator setup flow where a QR code is displayed — look for a “Can’t scan?” or “Manual entry” option to reveal the text secret. Setup:
  1. Open Target Inventory and select a target.
  2. Click Add Credential and choose Authenticator 2FA.
  3. Enter the username, password, and the base32 TOTP secret.
  4. Select the appropriate role and save.

​
SMS MFA

Username and password authentication where the second factor is an SMS verification code. MindFort provisions a dedicated phone number automatically and reads incoming codes during assessments.
FieldRequired
Credential NameYes
UsernameYes
PasswordYes
RoleYes (default: user)
DescriptionNo
A phone number is provisioned automatically when the credential is created. You will see it in the credentials table once provisioning completes. Register this number as the MFA phone number on the target account. Setup:
  1. Open Target Inventory and select a target.
  2. Click Add Credential and choose SMS MFA.
  3. Enter the username and password for the test account.
  4. Save the credential — a phone number will be provisioned.
  5. Copy the provisioned phone number from the credentials table and register it as the MFA number on your target application’s account settings.
  6. (Optional) If the target application sends a verification code to confirm the phone number during registration, click the message icon in the credentials table Actions column and press Check for Code to retrieve it. Enter the code in the target application to complete registration.

​
SMS Login

Phone-number-only authentication where a one-time code is sent via SMS instead of using a password. MindFort provisions a dedicated phone number and reads incoming codes during assessments.
FieldRequired
Credential NameYes
RoleYes (default: user)
DescriptionNo
No username or password is needed. A phone number is provisioned automatically. Setup:
  1. Open Target Inventory and select a target.
  2. Click Add Credential and choose SMS Login.
  3. Save the credential — a phone number will be provisioned.
  4. Copy the provisioned phone number from the credentials table and register it as a user on your target application.
  5. (Optional) If the target application sends a verification code during account creation, click the message icon in the credentials table Actions column and press Check for Code to retrieve it. Enter the code in the target application to complete registration.

​
Credential Guidelines

  • Use dedicated test accounts — avoid personal or production admin accounts.
  • Keep account access scoped to what you want tested.
  • Rotate credentials regularly.
  • For SMS credential types, contact support if the option is not available for your organization.
After adding credentials, add clear login instructions so agents can sign in to your target reliably: Writing Login Instructions