two-factor-authentication-best-practices

To add two-factor authentication to Better Auth, install the twoFactor server plugin and twoFactorClient plugin, run the CLI migration to add the twoFactorSecret column, and wire the login redirect to your verification page.

The best way to implement TOTP and backup codes is to enroll users via a QR code, verify time-based codes with optional trusted device support, and generate single-use backup codes during enablement for account recovery.

You handle a twoFactorRedirect by detecting when 2FA is required during login, routing users to a dedicated verification page, and preventing the creation of a full session until TOTP, OTP, or backup code verification succeeds.

Yes, Better Auth supports email and SMS OTP delivery by sending short-lived one-time codes, enforcing attempt limits, and verifying user-submitted OTPs during the sign-in flow.

Yes, you can regenerate backup codes on demand after enabling two-factor authentication, providing new single-use recovery codes for account access when your authenticator app or OTP delivery is unavailable.

Before setting up MFA enrollment, you need to configure the Better Auth server plugin with your issuer, add the client plugin with a verification page redirect, and run the migration to ensure the user table contains the required secret column.