Issue
Can users register multiple verification methods?
Resolution
Yes. In fact, it is encouraged so that users have a backup in case they forget or lose their primary method.
If a user sets up several verification methods, they're automatically prompted to provide the highest-priority method when they log in. Heroku uses this order of precedence for verification methods when logging in with MFA:
- Built-in authenticator
- Salesforce Authenticator
- Security keys
- Third-party time-based one-time passcode (TOTP) authenticator apps