skills.rest
saad-tayyab
saad-tayyabCOMMUNITY
Explore all skills by this author →
GitHub

two-factor-authentication-best-practices

Implement TOTP, OTP, and backup code two-factor authentication with Better Auth.

Updated Jul 24, 2026
Search Tags:#authentication#better-auth#otp#mfa#totp#backup codes#two-factor authentication
One-click install
npx skills add https://github.com/saad-tayyab/lumora --skill two-factor-authentication-best-practices-saad-tayyab
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: two-factor-authentication-best-practices
Source: https://github.com/saad-tayyab/lumora/tree/main/.agents/skills/two-factor-authentication-best-practices
Command: npx skills add https://github.com/saad-tayyab/lumora --skill two-factor-authentication-best-practices-saad-tayyab

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires better-auth, react-qr-code.

What problem does it solve? Adding multi-factor authentication to an application involves many moving parts: TOTP authenticator setup, OTP delivery over email or SMS, backup code recovery, trusted devices, and secure sign-in flows. This Skill provides complete, working patterns for implementing all of these with Better Auth's twoFactor plugin. ## Core Features & Use Cases - TOTP Authenticator Setup: Enable 2FA with password verification, generate TOTP URIs for QR codes, and verify codes with configurable digits and periods. - OTP via Email/SMS: Configure OTP delivery with custom send functions, attempt limits, and encrypted or hashed storage. - Backup Codes & Trusted Devices: Generate, regenerate, and verify single-use backup codes, and trust devices for 30 days to skip repeated verification. - Use Case: A user signs in with email and password, receives a twoFactorRedirect response, gets redirected to a /2fa page, and completes sign-in by entering a code from their authenticator app. ## Quick Start Add the twoFactor plugin to my Better Auth server config and show me how to enable and verify TOTP for a user.

Frequently Asked Questions about two-factor-authentication-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enable two-factor authentication with Better Auth?▼

Add the twoFactor plugin to your Better Auth server config with an issuer, add twoFactorClient to the client, then run the CLI migration. Call authClient.twoFactor.enable with the user's password to receive a TOTP URI and backup codes.

How to send OTP codes via email using Better Auth twoFactor?▼

Configure the otpOptions.sendOTP callback in the twoFactor plugin to call your email service with the generated code. Users then request codes with authClient.twoFactor.sendOtp and verify them with authClient.twoFactor.verifyOtp.

Does Better Auth 2FA support trusted devices?▼

Yes, pass trustDevice: true when verifying a TOTP, OTP, or backup code to skip 2FA on that device. The default trust duration is 30 days, configurable via trustDeviceMaxAge, and it refreshes on each sign-in.

How does the 2FA sign-in flow work in Better Auth?▼

After signIn.email succeeds, the response contains twoFactorRedirect: true when 2FA is required. Redirect the user to a verification page where they complete TOTP, OTP, or backup code verification, after which the session cookie is created.

What are the limitations of Better Auth two-factor authentication?▼

2FA can only be enabled for credential-based email and password accounts, not pure OAuth accounts. Rate limiting is fixed at 3 requests per 10 seconds for 2FA endpoints, and the temporary 2FA cookie expires after 10 minutes by default.

Related Skills

Explore More Software Engineering Skills→
Montte-erpMontte-erp
6

better-auth-best-practices

Configure Better Auth server and client for session-backed TypeScript authentication.

Official
Advanced
bobbymanninobobbymannino

two-factor-authentication-best-practices

Implement TOTP, OTP, backup codes, and trusted devices using Better Auth's twoFactor plugin.

Community
Intermediate
Fabric-ProFabric-Pro
3

threat-hunting

Detect security threats, vulnerabilities, and suspicious patterns in applications and infrastructure.

Official
Basic
CenredJunCenredJun

modern-auth-2026

Implement passwordless authentication with passkeys, OAuth, and magic links.

Community
Advanced