MFA login with TOTP sequence diagram template

Participants in this sequence diagram

• User
• Web app
• Auth service
• User DB
• Audit log

How to use this sequence diagram template

1. Click Open in the editor. The sequence diagram opens on a new page in FlowDiagram — nothing is uploaded and there is no sign-up.
2. Rename, add or delete shapes and drag them where you want; connectors stay attached as things move.
3. Drop in vendor logos from the library — 1,160 of them, including every AWS, Azure and Google Cloud service icon — or restyle it with the colour and theme controls.
4. Prefer text? Edit the Mermaid source below and paste it in through ☰ → Import diagram (see the Mermaid editor); it imports as an editable diagram.
5. Export to PNG, SVG or PDF, or press Ctrl+L for a link that carries the whole diagram.

Mermaid source

The whole template is the text below. Paste it into FlowDiagram, keep it in Git next to the code it describes, or hand it to an AI assistant to extend.

sequenceDiagram
  autonumber
  actor U as User
  participant Web as Web app
  participant Auth as Auth service
  participant DB as User DB
  participant Audit as Audit log
  U->>Web: Email + password
  Web->>Auth: POST /login
  Auth->>DB: Fetch user, password hash
  DB-->>Auth: Hash, mfa_enabled=true
  Auth-->>Web: mfa_required + challenge id
  Web->>U: Ask for 6-digit code
  loop Max 5 attempts
    U->>Web: TOTP code
    Web->>Auth: POST /login/mfa
    Auth->>Auth: Verify code for 30s window
    alt Code valid
      Auth->>Audit: Login success
      Auth-->>Web: Session token
      Web-->>U: Signed in
    else Code invalid
      Auth->>Audit: Failed MFA attempt
      Auth-->>Web: 401 try again
    end
  end
  Note right of Auth: After 5 failures the account is locked for 15 minutes

Related: Mermaid editor · All uml: sequence, class & state templates · All 521 templates