Admin removing second-factor methods

[winstonwolff]

Hello Jeremy—

We would like to give admins the ability to remove second factors from other users, e.g. if a user lost their phone. They cannot login to change things themselves. So the sys admin can go and delete that user's OTP second factor, and the user can login and Rodauth will ask them to setup another second factor.

My first thought on how to do this would be delete the appropriate row in the account_otp_keys or account_sms_codes tables. I wonder if there is another way you intend people to do this?

[jeremyevans]

You should be able to use the internal_request feature to do this, and issue internal requests to remove the second factors.

[winstonwolff]

Ah, thanks Jeremy. The answer's always in the docs. I just need to know where.