> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Duo Auth API

> Connect each client's Duo account to Triggr with a Duo Auth API application to verify users with Duo.

The Duo Auth integration verifies people with Duo Push, a passcode or a phone call, and enrols new users. To manage users, devices or settings, use [Duo](/integrations/duo/admin-api) or [Duo Accounts](/integrations/duo/accounts-api) alongside it.

Each Duo account needs Duo Premier, Duo Advantage, Duo Essentials, Duo Free or a trial, and you need the Owner, Administrator or Application Manager role.

## Set up Duo

Repeat these steps in each Duo account whose users Triggr should verify: your own, and each client's.

<Steps>
  <Step title="Add an Auth API application">
    In the Duo Admin Panel, go to **Applications → Application Catalog**, find Auth API (labelled 2FA) and click + Add.
  </Step>

  <Step title="Name it and grant user access">
    Give it a name users will recognise in Duo Push requests, such as your service desk's. Set User access to all users or the groups Triggr should verify, then click Save. If its New User policy denies access, enrolment returns a deny response instead of a link.
  </Step>

  <Step title="Copy the application details">
    Copy the Integration key, Secret key and API hostname from Details.
  </Step>
</Steps>

See Duo's [Auth API first steps](https://duo.com/docs/authapi#first-steps).

## Connect it in Triggr

<Steps>
  <Step title="Open the account's configuration">
    Go to **Integrations > Duo Auth** and click **Configure** on the client's row in the Per-Client Configuration card, or on the Base Configuration card for your own account.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/per-client-configuration.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=11464b4946bea0b580c73330d9114a41" alt="The Per-Client Configuration card listing Acme Corp and Globex, each Not Configured with Admin Consent Not Required and a Configure button." width="2272" height="646" data-path="images/integrations-common/per-client-configuration.png" />
    </Frame>
  </Step>

  <Step title="Enter the application details">
    Enter Hostname as `https://` plus the API hostname, with no trailing `/` or path (for example `https://api-XXXXXXXX.duosecurity.com`), add the SecretKey and IntegrationKey, then click **Save Configuration**.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/duo-auth-api/configure.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=b18c5e63872c5306d838948506d4c8e6" alt="The Duo Auth configuration window with Hostname, SecretKey and IntegrationKey fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button." width="1344" height="1354" data-path="images/duo-auth-api/configure.png" />
    </Frame>
  </Step>
</Steps>

Per-client integrations never fall back to the Base Configuration, so every client whose workflows use Duo Auth needs its own row. Run the Check action in a workflow to test the keys. When authenticating a user, fill in either the username or Duo's user ID, not both.

## Troubleshooting

<AccordionGroup>
  <Accordion title="401 errors">
    40102 means IntegrationKey is wrong or from a different account to Hostname. 40103 means SecretKey is wrong (perhaps reset in Duo) or Hostname has a trailing `/` or path.
  </Accordion>

  <Accordion title="403 errors (40301)">
    The keys come from an Admin API application. Duo Auth needs an Auth API application.
  </Accordion>

  <Accordion title="Users get a deny response">
    Check the user is included in the application's User access, and the policies that apply to it.
  </Accordion>

  <Accordion title="no Duo Auth integration is configured for this client">
    Configure Duo Auth for that client on the Per-Client Configuration card.
  </Accordion>

  <Accordion title="429 errors">
    If a workflow polls for an authentication result, leave a delay between checks.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.