# TiDB Cloud Administrator Authentication

+ Authentication
  + Password authentication
  + 3rd-party Single Sign-on (SSO)
  + MFA is supported
+ API Key
+ ALWAYS protect your TiDB Cloud account
![`smart`](TiDBCloudCreateAPIKey_aa_001_20231016.png)
![`smart`](TiDBCloudOrgSSO_aa_001_20231016.png)

------------------------------------------------------------------------------
Currently, you can do single sign-on via Google, GitHub, and Microsoft. TiDB Cloud also supports organization SSO, which allows organization members to log in, from a custom login page of TiDB Cloud, using the authentication methods specified by your organization. The Cloud Organization SSO is disabled by default.

For TiDB Cloud Web Console, you can enable MFA. If you log in with SSO, you only need to enable and configure MFA on your Google Workspace, GitHub, or Microsoft, you cannot enable MFA on TiDB Cloud Web Console.

For programmatic access to your organization or project, the administrator of TiDB Cloud can create organization-scoped API keys. You must turn on the organization-level setting that only allows programmatic API keys to be used. The creation and deletion of keys will be logged in TiDB Cloud Web Console Audit.