skills.rest
Ishaq74
Ishaq74COMMUNITY
Explore all skills by this author →
GitHub

two-factor-authentication-best-practices

Configure TOTP, OTP, backup codes, and trusted devices with Better Auth's twoFactor plugin.

Updated Mar 14, 2026
Search Tags:#better-auth#otp#mfa#totp#backup codes#two-factor authentication#authentication security
One-click install
npx skills add https://github.com/Ishaq74/atomic --skill two-factor-authentication-best-practices-ishaq74
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: two-factor-authentication-best-practices
Source: https://github.com/Ishaq74/atomic/tree/main/.github/skills/twoFactor
Command: npx skills add https://github.com/Ishaq74/atomic --skill two-factor-authentication-best-practices-ishaq74

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires better-auth.

What problem does it solve? Implementing multi-factor authentication from scratch is error-prone and security-critical. This Skill provides complete, working patterns for adding two-factor authentication to applications using Better Auth's twoFactor plugin, covering TOTP authenticator apps, email/SMS OTP, backup codes, and trusted devices. ## Core Features & Use Cases - TOTP Authenticator Setup: Enable 2FA with QR code generation, configurable digits and period, and code verification with time-window tolerance. - OTP via Email/SMS: Send one-time codes with configurable validity period, attempt limits, and encrypted or hashed storage. - Backup Codes & Recovery: Generate, regenerate, and verify single-use backup codes with encrypted storage options. - Sign-In Flow Handling: Detect twoFactorRedirect responses, manage temporary 2FA cookies, and support trusted devices with 30-day trust duration. - Use Case: A developer adding MFA to a Better Auth application can follow the complete configuration example to set up TOTP, OTP delivery via their email service, backup codes, and rate limiting in one pass. ## Quick Start Ask the AI to add two-factor authentication with TOTP and email OTP to your Better Auth configuration using the twoFactor plugin.

Frequently Asked Questions about two-factor-authentication-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enable two-factor authentication with Better Auth?▼

Add the twoFactor plugin to your Better Auth server config with an issuer, add twoFactorClient to the client, then run npx @better-auth/cli migrate. Users enable 2FA by calling authClient.twoFactor.enable with their password, which returns a TOTP URI and backup codes.

How to send OTP codes via email in Better Auth 2FA?▼

Configure the otpOptions.sendOTP callback in the twoFactor plugin to call your email service with the user and otp values. You can also set the code validity period, digit count, allowed attempts, and storage mode such as encrypted or hashed.

Does Better Auth twoFactor support trusted devices?▼

Yes, pass trustDevice: true when verifying a TOTP, OTP, or backup code to mark the device as trusted. The default trust duration is 30 days via trustDeviceMaxAge, and it refreshes on each subsequent sign-in.

How does the 2FA sign-in flow work in Better Auth?▼

After calling signIn.email, check for twoFactorRedirect in the response and redirect the user to a verification page. A temporary 2FA cookie is issued, and the session is created only after successful TOTP, OTP, or backup code verification.

Can I use Better Auth 2FA with OAuth-only accounts?▼

No, two-factor authentication can only be enabled for credential accounts using email and password. The enable and disable methods both require password verification, so OAuth-only users cannot activate 2FA through this plugin.

How are TOTP secrets and backup codes stored securely?▼

TOTP secrets are encrypted with the auth secret, and backup codes are encrypted by default. OTP codes support plain, encrypted, or hashed storage, and you can supply custom encrypt and decrypt functions for full control.

Related Skills

Explore More Software Engineering Skills→
legions-developerlegions-developer
885

better-auth-best-practices

Configure Better Auth for authentication workflows with database adapters and environment variables.

Community
Intermediate
dotlab-hqdotlab-hq
1

two-factor-authentication-best-practices

Configure Better Auth two-factor authentication with TOTP, OTP, and backup codes.

Official
Advanced
pachcapachca
10

pachca-security

Retrieves security logs and monitors suspicious events via Pachca CLI.

Official
Intermediate
CenredJunCenredJun

modern-auth-2026

Implement passwordless authentication with passkeys, OAuth, and magic links.

Community
Advanced