two-factor-authentication-best-practices

Implement TOTP, OTP, and backup codes for web app login security.

Updated Apr 16, 2026

Search Tags:#otp #mfa #sign-in #totp #two-factor-authentication #backup-codes #trusted-devices

Ready to run

npx skills add https://github.com/cristianbc2004/Project_BettherAuth --skill two-factor-authentication-best-practices-cristianbc2004

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: two-factor-authentication-best-practices
Source: https://github.com/cristianbc2004/Project_BettherAuth/tree/main/.agents/skills/two-factor-authentication-best-practices
Command: npx skills add https://github.com/cristianbc2004/Project_BettherAuth --skill two-factor-authentication-best-practices-cristianbc2004

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Configure 2FA to improve login security by implementing TOTP, OTP, backup codes, trusted devices, and secure sign-in flows.

Core Features & Use Cases

TOTP setup and QR-code provisioning for authenticator apps
OTP delivery via email/SMS with configurable expiration and retry limits
Backup codes generation, display, and regeneration for account recovery
Trust device handling and seamless 2FA during sign-in
Server-side and client-side plugin configuration with issuer and options Use case: when users require MFA for secure login on web apps.

Quick Start

Add the twoFactor() plugin to your server with an issuer, add twoFactorClient() to your client, run npx @better-auth/cli migrate, and verify that the twoFactorSecret column exists on the user table.

Frequently Asked Questions about two-factor-authentication-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement two-factor authentication using TOTP and backup codes for web app logins?▼

Implement two-factor authentication by configuring the twoFactor plugin with an issuer, adding twoFactorClient to your client, and running a database migration to add the twoFactorSecret field. This enables TOTP setup, OTP delivery, backup code generation, and trusted device handling for secure sign-in flows.

What is the best way to set up TOTP QR-code provisioning for an authenticator app?▼

TOTP setup and QR-code provisioning is configured by adding the twoFactor() plugin to your server with a specified issuer. The client-side twoFactorClient() integration allows users to scan the QR code with authenticator apps to enable MFA for secure web app login.

Can I configure OTP delivery via email or SMS with custom expiration limits?▼

Yes, OTP delivery via email or SMS supports configurable expiration and retry limits. You can define these parameters using optional otpOptions when configuring the twoFactor plugin to manage how multi-factor authentication codes are sent and validated.

How do I generate and manage backup codes for multi-factor authentication account recovery?▼

Backup codes for account recovery are generated and displayed through the twoFactor plugin configuration. Users can use these codes to bypass MFA during sign-in if they lose access to their authenticator app, with options for code regeneration.

Do I need to run a database migration before enabling two-factor authentication?▼

Yes, you must run npx @better-auth/cli migrate to add the twoFactorSecret column to your user table. This database migration is required to securely store the encrypted secrets needed for TOTP and multi-factor authentication.

How does trusted device handling work during multi-factor authentication sign-in flows?▼

Trusted device handling allows seamless multi-factor authentication during sign-in by marking specific devices as trusted. Once verified, users on trusted devices can bypass repeated MFA challenges, reducing friction while maintaining high login security standards.