How user can disable/enable this feature?

[AnggitHerdianto]

Hi,

I just installed this module on my Keycloak 25.0, and it’s working well. However, the issue is that users can't adjust it. When I set up on the authentication flow, it’s always enabled. I need users to be able to enable/disable this OTP.

Any ideas on how to achieve this?

[mesutpiskin]

Users can already manage their email OTP credential through the Keycloak Account Management page (typically at /realms/{realm}/account → Signing In → Two-Factor Authentication).

The behavior depends on the Skip Setup config on your authenticator:

• skipSetup=true (default): All users with an email address are automatically considered configured — there is nothing to enable or disable individually. If you want users to be able to opt out, set skipSetup=false.

• skipSetup=false: Users must explicitly enroll by completing the setup flow. Once enrolled, a credential appears in their account management page with a Remove button. Removing it disables email 2FA for that user (until they enroll again).

So with skipSetup=false, users have full control: they can enroll via the setup flow and remove the credential from their account page whenever they want.