Skip to main content
The Duo Auth integration verifies people with Duo Push, a passcode or a phone call, and enrols new users. To manage users, devices or settings, use Duo or Duo Accounts alongside it. Each Duo account needs Duo Premier, Duo Advantage, Duo Essentials, Duo Free or a trial, and you need the Owner, Administrator or Application Manager role.

​
Set up Duo

Repeat these steps in each Duo account whose users Triggr should verify: your own, and each client’s.
1

Add an Auth API application

In the Duo Admin Panel, go to Applications → Application Catalog, find Auth API (labelled 2FA) and click + Add.
2

Name it and grant user access

Give it a name users will recognise in Duo Push requests, such as your service desk’s. Set User access to all users or the groups Triggr should verify, then click Save. If its New User policy denies access, enrolment returns a deny response instead of a link.
3

Copy the application details

Copy the Integration key, Secret key and API hostname from Details.
See Duo’s Auth API first steps.

​
Connect it in Triggr

1

Open the account's configuration

Go to Integrations > Duo Auth and click Configure on the client’s row in the Per-Client Configuration card, or on the Base Configuration card for your own account.
The Per-Client Configuration card listing Acme Corp and Globex, each Not Configured with Admin Consent Not Required and a Configure button.
2

Enter the application details

Enter Hostname as https:// plus the API hostname, with no trailing / or path (for example https://api-XXXXXXXX.duosecurity.com), add the SecretKey and IntegrationKey, then click Save Configuration.
The Duo Auth configuration window with Hostname, SecretKey and IntegrationKey fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button.
Per-client integrations never fall back to the Base Configuration, so every client whose workflows use Duo Auth needs its own row. Run the Check action in a workflow to test the keys. When authenticating a user, fill in either the username or Duo’s user ID, not both.

​
Troubleshooting

40102 means IntegrationKey is wrong or from a different account to Hostname. 40103 means SecretKey is wrong (perhaps reset in Duo) or Hostname has a trailing / or path.
The keys come from an Admin API application. Duo Auth needs an Auth API application.
Check the user is included in the application’s User access, and the policies that apply to it.
Configure Duo Auth for that client on the Per-Client Configuration card.
If a workflow polls for an authentication result, leave a delay between checks.