two-factor-authentication-best-practices

Implement two-factor authentication by configuring the twoFactor plugin with an issuer, adding twoFactorClient to your client, and running a database migration to add the twoFactorSecret field. This enables TOTP setup, OTP delivery, backup code generation, and trusted device handling for secure sign-in flows.

TOTP setup and QR-code provisioning is configured by adding the twoFactor() plugin to your server with a specified issuer. The client-side twoFactorClient() integration allows users to scan the QR code with authenticator apps to enable MFA for secure web app login.

Yes, OTP delivery via email or SMS supports configurable expiration and retry limits. You can define these parameters using optional otpOptions when configuring the twoFactor plugin to manage how multi-factor authentication codes are sent and validated.

Backup codes for account recovery are generated and displayed through the twoFactor plugin configuration. Users can use these codes to bypass MFA during sign-in if they lose access to their authenticator app, with options for code regeneration.

Yes, you must run npx @better-auth/cli migrate to add the twoFactorSecret column to your user table. This database migration is required to securely store the encrypted secrets needed for TOTP and multi-factor authentication.

Trusted device handling allows seamless multi-factor authentication during sign-in by marking specific devices as trusted. Once verified, users on trusted devices can bypass repeated MFA challenges, reducing friction while maintaining high login security standards.