skills.rest
masakinihirota
masakinihirotaCOMMUNITY
Explore all skills by this author →
𝕏@masakinihirotaGitHub

two-factor-authentication-best-practices

Implements secure two-factor authentication using Better Auth's twoFactor plugin.

Updated Jul 21, 2026
Search Tags:#security#authentication#better-auth#otp#totp#backup codes#two-factor authentication
One-click install
npx skills add https://github.com/masakinihirota/2026src-ni --skill two-factor-authentication-best-practices-masakinihirota
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: two-factor-authentication-best-practices
Source: https://github.com/masakinihirota/2026src-ni/tree/main/.agents/skills/two-factor-authentication-best-practices
Command: npx skills add https://github.com/masakinihirota/2026src-ni --skill two-factor-authentication-best-practices-masakinihirota

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires better-auth, react-qr-code.

What problem does it solve? Adding two-factor authentication to an application involves many moving parts—TOTP setup, OTP delivery, backup codes, trusted devices, and secure session handling. This Skill provides guidance and enforcement rules for implementing 2FA correctly with Better Auth's twoFactor plugin, avoiding common security mistakes. ## Core Features & Use Cases - TOTP and OTP Configuration: Set up authenticator-app codes and email/SMS one-time passwords with proper issuer, period, digit, and storage options. - Backup Codes and Recovery: Generate, display, regenerate, and verify single-use backup codes for account recovery. - Secure Sign-In Flow: Handle twoFactorRedirect responses, temporary two-factor cookies, trusted devices, rate limiting, and encrypted storage of secrets. - Use Case: When adding 2FA to a Better Auth-based app, use this Skill to configure the plugin, build the verification UI, and enforce security best practices like encrypted OTP storage and constant-time comparison. ## Quick Start Add two-factor authentication to my Better Auth setup with TOTP, backup codes, and a verification page.

Frequently Asked Questions about two-factor-authentication-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add two-factor authentication with Better Auth?▼

Add the twoFactor plugin to your Better Auth config with your app name as issuer, then run npx @better-auth/cli migrate to create the required database fields. On the client, add twoFactorClient with an onTwoFactorRedirect handler pointing to your verification page.

How do I enable TOTP authenticator app setup for users?▼

Call authClient.twoFactor.enable with the user's password, which returns a totpURI and backup codes. Render the totpURI as a QR code with a library like react-qr-code, then have the user verify a code to activate 2FA.

Does Better Auth 2FA work with social login accounts?▼

No, two-factor authentication can only be enabled for credential (email/password) accounts. For social accounts, the identity provider is assumed to handle 2FA on its own side.

How should OTP codes be stored in the database?▼

Configure the storeOTP option as plain, encrypted, or hashed, with encrypted recommended. You can also supply custom encrypt and decrypt functions for full control over OTP storage security.

Why is twoFactorEnabled still false after enabling 2FA?▼

The flag is only set to true after the user successfully verifies their first TOTP code, confirming the authenticator app is configured. Setting skipVerificationOnEnable bypasses this but is not recommended.

How do trusted devices skip 2FA on sign-in?▼

Pass trustDevice: true when verifying a TOTP, OTP, or backup code to remember the device. The trust period defaults to 30 days via trustDeviceMaxAge and refreshes on each successful sign-in within the window.

Related Skills

Explore More Software Engineering Skills→
techwithanirudhtechwithanirudh
1

email-and-password-best-practices

Configure email verification, password reset flows, and password policies for Better Auth.

Community
Advanced
dotlab-hqdotlab-hq
1

two-factor-authentication-best-practices

Configure Better Auth two-factor authentication with TOTP, OTP, and backup codes.

Official
Advanced
GELLIFYGELLIFY
6

two-factor-authentication-best-practices

Implement TOTP, OTP, and backup codes with Better Auth.

Official
Advanced
cristianbc2004cristianbc2004

two-factor-authentication-best-practices

Implement TOTP, OTP, and backup codes for web app login security.

Community
Advanced