Required Use of Two-Factor Authentication Using Login.Gov for eRA's External Modules in 2021
Notice Number:

Key Dates

Release Date:

December 11, 2020

Related Announcements

NOT-OD-21-172 - Adjusted Timeline for Requiring Two-Factor Authentication to Access eRA Modules Using Login.Gov or InCommon Federated Accounts

Issued by


Centers for Disease Control and Prevention (CDC)

U.S. Food and Drug Administration (FDA)

Agency for Healthcare Research and Quality (AHRQ)

Office of Research and Development (ORD), Department of Veterans Affairs (VA)

Substance Abuse and Mental Health Services Administration (SAMHSA)



In April 2020, eRA launched the availability of for its external modules for optional use. is a shared service authentication provider managed by General Services Administration (GSA). With one account, users can sign into multiple government agency systems while taking advantage of’s two-factor authentication capabilities that ensure the security of their personal information.

NIH/eRA and its partner agencies are now expanding the use of two-factor authentication via for all external user communities that access eRA’s external modules including Commons, Commons Mobile, Internet Assisted Review (IAR) and ASSIST. Beginning soon, NIH/eRA and its partner agencies will require all external users to only use to access eRA’s external modules including Commons, Commons Mobile, IAR and ASSIST.


Initially, two-factor authentication requirements will be enforced for reviewers using the IAR module. Starting December 14, 2020, the new requirement will be phased in for reviewers, meeting by meeting, effective for review meetings February 1, 2021 and beyond.

By September 15, 2021, all external users will be required to use when logging into eRA systems. All users of eRA Commons, Commons Mobile and ASSIST are encouraged to begin the switchover now, before the mandatory deadline.

Note that when an external user is transitioned to required use of, the ability to use eRA credentials (username and password) or InCommon Federated credentials (where organizations authenticate their own users) will no longer be supported.

NIH is working with the InCommon Federation community to identify a solution that allows the InCommon Federation platform to support two-factor authentication requirements and continue its availability in the future.

At this time, users can only have one account associated with one eRA account. Users with multiple eRA accounts should review the FAQs for additional information.


See step-by-step instructions, FAQs, video tutorials and more at the Access eRA Modules via webpage.

Users with multiple eRA accounts should review the FAQ If I have more than one eRA account, can I use my account for all of those eRA accounts to log in to eRA?


Please direct all inquiries to:

eRA Service Desk

Submit a web ticket:


Weekly TOC for this Announcement
NIH Funding Opportunities and Notices