We are establishing a SF Community and Requiring Community Users to have two factor authentication. We have an Apex Batch that creates new Users, deactivates Users who no longer have assignments that require community access, and then reactivates existing Users that are delegated new assignments. All of this works correctly.

However, when an inactive User is made active, they still retain their old One-Time Password Generator. We would like the ability to remove those Generators when we re-activate the User. When I look through the WSDL I don't see a field or flag that would allow me to do that. Where/How is that One-Time Password Generator stored? Is there a way to remove that Generator via Apex?

  • I don't believe this is available via apex. The objects I see related to this only have query ability not update. developer.salesforce.com/docs/atlas.en-us.object_reference.meta/…
    – Eric
    Commented Apr 7, 2017 at 20:02
  • SWEET! Thanks to your comment I was able to find the answer!!
    – RD3
    Commented Apr 7, 2017 at 20:16
  • Please do post it as an answer to your own questions then and let us know how you resolved it
    – Eric
    Commented Apr 7, 2017 at 20:17

1 Answer 1


For future reference, the One-Time Password Generator information is stored in the TwoFactorInfo object. This can be queried by the UserId and the object can be deleted. Deleting the object will remove the Generator from the User. Sample Code:

// Where uid is the UserId for the User from which you wish to remove the token generator.
TwoFactorInfo tfi = [ SELECT Id, UserId FROM TwoFactorInfo WHERE UserId = :uid ];
Database.Delete( tfi );
  • Interesting. The Docs for it do not say it supports Delete. Maybe that is just via API. - Don't forget to come back in a few days and mark this as accepted
    – Eric
    Commented Apr 7, 2017 at 20:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .