two-factor-authentication-best-practices

Two-factor authentication setup requires generating a TOTP URI, displaying a QR code, and verifying codes with clock drift tolerance. OTP delivery via email or SMS uses short-lived codes with configurable periods, digits, and attempt limits. Password verification is required before enabling.

Backup codes for 2FA account recovery are generated as single-use codes, displayed securely to the user for safekeeping, and can be regenerated when needed. Encrypted storage options ensure secrets and codes remain protected on the server.

Two-factor authentication supports trusted devices and sign-in flows for both web and mobile clients by handling trust-device tokens, temporary 2FA cookies during sign-in, and server or client redirection when two-factor verification is required.

Two-factor authentication configuration includes security controls for encrypted storage of secrets and codes, rate limiting to prevent brute-force attacks, and configurable TOTP and OTP parameters such as period, digits, and attempt limits.

Two-factor authentication integrates with the Better Auth twoFactor plugin to provide TOTP authenticator setup, OTP delivery via email or SMS, backup code management, and trusted device workflows with encrypted storage and rate limiting.