two-factor-authentication-best-practices

Implement two-factor authentication in Better Auth by configuring the twoFactor plugin to manage TOTP, OTP, and backup codes across web and API authentication flows. You can customize options for TOTP, OTP, backup codes, trusted devices, and 2FA cookie max age.

Handle 2FA backup codes and trusted devices by configuring backupCodeOptions and trustDeviceMaxAge in your authentication setup. This enables secure recovery access and maintains sessions on recognized devices without repeated 2FA verification prompts.

Better Auth supports TOTP and OTP delivery for both server and client integrations. The twoFactor plugin provides configurable totpOptions and otpOptions to manage verification across front-end and back-end web and API authentication contexts.

Apply security considerations for two-factor authentication by enforcing encryption and rate limiting within your 2FA flows. The implementation requires secure defaults for enabling, verifying, and recovering 2FA states across credential-based sign-ins.

You can customize the 2FA cookie max age and trusted device duration by configuring twoFactorCookieMaxAge and trustDeviceMaxAge. These options control how long a trusted device session remains valid before requiring re-authentication.