> ## Documentation Index
> Fetch the complete documentation index at: https://kb.mspprocess.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Duo Auth API

> Connect each client's Duo account to Triggr with a Duo Auth API application to verify users with Duo.

The Duo Auth integration verifies people with Duo Push, a passcode or a phone call, and enrols new users. To manage users, devices or settings, use [Duo](https://kb.mspprocess.com/integrations/duo/admin-api.md) or [Duo Accounts](https://kb.mspprocess.com/integrations/duo/accounts-api.md) alongside it.

Each Duo account needs Duo Premier, Duo Advantage, Duo Essentials, Duo Free or a trial, and you need the Owner, Administrator or Application Manager role.

## Set up Duo

Repeat these steps in each Duo account whose users Triggr should verify: your own, and each client's.

**1. Add an Auth API application**

In the Duo Admin Panel, go to **Applications → Application Catalog**, find Auth API (labelled 2FA) and click + Add.

**2. Name it and grant user access**

Give it a name users will recognise in Duo Push requests, such as your service desk's. Set User access to all users or the groups Triggr should verify, then click Save. If its New User policy denies access, enrolment returns a deny response instead of a link.

**3. Copy the application details**

Copy the Integration key, Secret key and API hostname from Details.

See Duo's [Auth API first steps](https://duo.com/docs/authapi#first-steps).

## Connect it in Triggr

**1. Open the account's configuration**

Go to **Integrations > Duo Auth** and click **Configure** on the client's row in the Per-Client Configuration card, or on the Base Configuration card for your own account.

![The Per-Client Configuration card listing Acme Corp and Globex, each Not Configured with Admin Consent Not Required and a Configure button.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/per-client-configuration.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=11464b4946bea0b580c73330d9114a41)

**2. Enter the application details**

Enter Hostname as `https://` plus the API hostname, with no trailing `/` or path (for example `https://api-XXXXXXXX.duosecurity.com`), add the SecretKey and IntegrationKey, then click **Save Configuration**.

![The Duo Auth configuration window with Hostname, SecretKey and IntegrationKey fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/duo-auth-api/configure.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=b18c5e63872c5306d838948506d4c8e6)

Per-client integrations never fall back to the Base Configuration, so every client whose workflows use Duo Auth needs its own row. Run the Check action in a workflow to test the keys. When authenticating a user, fill in either the username or Duo's user ID, not both.

## Troubleshooting

> [accordion] 401 errors
>
> 40102 means IntegrationKey is wrong or from a different account to Hostname. 40103 means SecretKey is wrong (perhaps reset in Duo) or Hostname has a trailing `/` or path.

> [accordion] 403 errors (40301)
>
> The keys come from an Admin API application. Duo Auth needs an Auth API application.

> [accordion] Users get a deny response
>
> Check the user is included in the application's User access, and the policies that apply to it.

> [accordion] no Duo Auth integration is configured for this client
>
> Configure Duo Auth for that client on the Per-Client Configuration card.

> [accordion] 429 errors
>
> If a workflow polls for an authentication result, leave a delay between checks.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.