two-factor-authentication-best-practices

Add the twoFactor plugin to your Better Auth server config with an issuer, add twoFactorClient to the client config, then run the Better Auth CLI migrate command. Users enable 2FA by calling authClient.twoFactor.enable with their password.

Call authClient.twoFactor.enable with the user's password to receive a totpURI, render it as a QR code with a library like react-qr-code, then verify the first code with authClient.twoFactor.verifyTotp. Digits and period are configurable via totpOptions.

Yes, the twoFactor plugin supports OTP delivery through a custom sendOTP function in otpOptions, where you integrate your own email or SMS provider. You can configure code validity period, digit count, allowed attempts, and storage mode.

After calling signIn.email, check for twoFactorRedirect in the response and route the user to a verification page. The session is only created after successful TOTP, OTP, or backup code verification, with a temporary 2FA cookie valid for 10 minutes by default.

No, two-factor authentication can only be enabled for credential accounts using email and password, because enabling and disabling 2FA requires password verification. OAuth-only accounts cannot complete this step.

TOTP secrets are encrypted with the auth secret, backup codes are encrypted by default, and OTP storage is configurable as plain, encrypted, or hashed via the storeOTP option. Verification uses constant-time comparison.