diff --git a/env/aidbox b/env/aidbox
index 79c909d..998fd84 100644
--- a/env/aidbox
+++ b/env/aidbox
@@ -37,3 +37,4 @@ TWO_FACTOR_WEBHOOK_URL="http://devbox:8080/webhook/two-factor-confirmation"
 TWO_FACTOR_WEBHOOK_AUTHORIZATION="Basic cm9vdDpzZWNyZXQ=" # root:secret
 AIDBOX_CSS=http://localhost:3000/aidbox.css
 SMTP_PROVIDER=console
+TWO_FA_SECRET=secret
diff --git a/env/aidbox-2fa b/env/aidbox-2fa
index 2017df3..ed877d9 100644
--- a/env/aidbox-2fa
+++ b/env/aidbox-2fa
@@ -13,4 +13,4 @@ AIO_HOST=0.0.0.0
 TWO_FACTOR_ISSUER_NAME=MammoChat
 TWO_FACTOR_VALID_PAST_TOKENS_COUNT=5
 TWO_FACTOR_WEBHOOK_URL="http://devbox:8080/webhook/two-factor-confirmation"
-TWO_FACTOR_WEBHOOK_AUTHORIZATION="Basic cm9vdDpzZWNyZXQ=" # root:secret
\ No newline at end of file
+TWO_FACTOR_WEBHOOK_AUTHORIZATION="Basic dHdvZmF3ZWJob29rOnNlY3JldA==" # twofawebhook:secret
\ No newline at end of file
diff --git a/zenproject/zrc/system.edn b/zenproject/zrc/system.edn
index 4677fc5..59f5b21 100644
--- a/zenproject/zrc/system.edn
+++ b/zenproject/zrc/system.edn
@@ -38,6 +38,8 @@
                        :secret "123456"}
             :anonymous {:grant_types [:basic]
                         :secret "secret"}
+            :twofawebhook {:grant_types [:basic]
+                           :secret #env TWO_FA_SECRET}
             :patient-questionnaire {:grant_types [:basic]
                                     :secret "secret"}}
    :AidboxConfig {:provider {:provider
@@ -97,6 +99,9 @@
                                                    :roleName "patient"}
                              :receptionist-role-policy {:engine "allow"
                                                         :roleName "receptionist"}
+                             :twofawebhookaccess
+                             {:engine "allow"
+                              :link [{:resourceType "Client" :id "twofawebhook"}]}
                              :public-appointment-policy
                              {:engine "allow"
                               :link [{:resourceType "Client" :id "anonymous"}]}