two-factor-authentication-best-practices

Implement multi-factor authentication with TOTP, OTP, backup codes, and trusted devices.

885|108|Updated Apr 30, 2025

Search Tags:#better-auth #otp #mfa #totp #backup codes #two-factor authentication #trusted devices

Ready to run

npx skills add https://github.com/legions-developer/invoicely --skill two-factor-authentication-best-practices-legions-developer

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: two-factor-authentication-best-practices
Source: https://github.com/legions-developer/invoicely/tree/main/.agents/skills/twoFactor
Command: npx skills add https://github.com/legions-developer/invoicely --skill two-factor-authentication-best-practices-legions-developer

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you harden sign-in security by adding multi-factor authentication (2FA) to prevent account takeovers when passwords are reused or leaked.

Core Features & Use Cases

TOTP authenticator setup (QR + verification): Configure and enroll users using an authenticator app, then verify time-based codes with optional trusted device support.
Email/SMS OTP flows: Deliver short-lived one-time codes, enforce attempt limits, and verify user-submitted OTPs during sign-in.
Backup codes + recovery: Generate single-use backup codes on enablement, regenerate them on demand, and use them for account access when authenticator/OTP is unavailable.
Sign-in gating and redirects: Detect when 2FA is required during login and route users to a verification page before creating a full session.

Quick Start

Add the Better Auth twoFactor plugin on the server with your issuer, add the twoFactorClient plugin on the client with a redirect to your /2fa page, run the Better Auth CLI migration, and confirm the twoFactorSecret column exists on the user table.

Frequently Asked Questions about two-factor-authentication-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I add two-factor authentication to Better Auth?▼

To add two-factor authentication to Better Auth, install the twoFactor server plugin and twoFactorClient plugin, run the CLI migration to add the twoFactorSecret column, and wire the login redirect to your verification page.

What is the best way to implement TOTP and backup codes for user sign-in?▼

The best way to implement TOTP and backup codes is to enroll users via a QR code, verify time-based codes with optional trusted device support, and generate single-use backup codes during enablement for account recovery.

How do I handle a twoFactorRedirect during mid-login verification?▼

You handle a twoFactorRedirect by detecting when 2FA is required during login, routing users to a dedicated verification page, and preventing the creation of a full session until TOTP, OTP, or backup code verification succeeds.

Does Better Auth support email and SMS OTP delivery?▼

Yes, Better Auth supports email and SMS OTP delivery by sending short-lived one-time codes, enforcing attempt limits, and verifying user-submitted OTPs during the sign-in flow.

Can I regenerate backup codes after enabling two-factor authentication?▼

Yes, you can regenerate backup codes on demand after enabling two-factor authentication, providing new single-use recovery codes for account access when your authenticator app or OTP delivery is unavailable.

What do I need to configure before setting up MFA enrollment?▼

Before setting up MFA enrollment, you need to configure the Better Auth server plugin with your issuer, add the client plugin with a verification page redirect, and run the migration to ensure the user table contains the required secret column.