The rubygems_mfa_required metadata key is a gemspec setting that makes multi-factor authentication mandatory for a gem's owners. Once you release a version with the key set to true, that version and every later one can only be pushed by owners who have MFA enabled on RubyGems.
How to turn it on
Add one line to the metadata hash in your gemspec. The value must be a string.
spec.metadata = { "rubygems_mfa_required" => "true" }
Then release a new version as usual. The requirement starts with the version that carries the key.
What owners see
If an owner without MFA runs gem push, the push fails with a message that the gem requires owners to enable MFA before pushing a new version. On the gem page, the sidebar shows "NEW VERSIONS REQUIRE MFA", and versions published under the rule show "VERSION PUBLISHED WITH MFA".
That label helps downstream users. It tells them the release came from an account that passed a second factor, though it says nothing about whether the code itself is safe.
What it does and does not cover
| Question | Answer |
|---|---|
| Does it cover old versions? | No. It applies from the opted in version onward. |
| Does it apply to all owners? | Yes, every owner of that gem must have MFA. |
| Does it stop a stolen session? | No. It reduces the value of a stolen password, not of a hijacked session. |
| Does it replace trusted publishing? | No. They solve different problems. |
If you publish from CI through trusted publishing, there is no human push to protect, but the owner accounts that can change gem settings still matter. See how to set up RubyGems trusted publishing.
Turning it off, and why that takes a release
Set the value to "false" to lift the requirement. RubyGems enforces the rule on the version being published, so it is only lifted after a gem is successfully published with the key set to false. You cannot flip it from a settings page. That is a useful property: someone who briefly gets into an account cannot simply untick the box. They would need to push a version, and that push itself needs MFA.
A short rollout plan
- Confirm every owner of the gem has MFA enabled. Remove owners who no longer contribute, using the steps in remove a maintainer access offboarding checklist.
- Add the key to the gemspec.
- Release a patch version.
- Check the gem page for the "NEW VERSIONS REQUIRE MFA" label.
- Note the policy in your contributing guide.
On the Safeguard side, dependency scanning and SBOM generation can show which of your dependencies are maintained by accounts you rely on; the free scan lives at gold.safeguard.sh/scan.
Quick check
Is the value a boolean or a string?
A string. Use "true" in quotes inside the metadata hash.
Can I remove the requirement from the website?
No. The guide says it is lifted only after a successful publish with the key set to false.
Sources
Last reviewed: 19 October 2026.
