<a id="global-mfa" />

**`[-mfa | VAULT_MFA] (string : "")`** <EnterpriseAlert inline="true" />

A multi-factor authentication (MFA) credential, in the format
`mfa_method_name[:key[=value]]`, that the CLI should use to authenticate to
Vault. The CLI adds MFA credentials to the `X-Vault-MFA` header when calling the
underlying API endpoint.

**Examples**:

- CLI flag: `-mfa "totp:password=12345"`
- Environment variable: `export VAULT_MFA="totp:password=12345"`

<Note>

  The `VAULT_MFA` environment variable only accepts one MFA method specification
  and one credential for the specified method. To supply multiple credentials or
  MFA methods, use the `-mfa` CLI flag and repeat the flag as needed.

</Note>
