Agent skill · security · better-auth
two-factor-authentication-best-practices
Configure TOTP authenticator apps, send OTP codes via email/SMS, manage backup codes, handle trusted devices, and implement 2FA sign-in flows using Better Auth's twoFactor plugin. Use when users need MFA, multi-factor authentication, authenticator setup, or login security with Better Auth.
Why this skill is useful
Provides specific implementation details and configuration patterns for integrating two-factor authentication using Better Auth's plugins that the AI wouldn't reliably generate on its own.
What it needs
Requires @better-auth/cli installed locally. About 4k tokens when loaded. Last updated 2026-07-11. 206 stars on the source repository.
What this skill does
Setup 1. Add twoFactor() plugin to server config with issuer 2. Add twoFactorClient() plugin to client config 3. Run npx auth@latest migrate (built-in adapter) or generate + push for Drizzle/Prisma 4. Verify: check that twoFactorSecret column exists on user table Client-Side Setup Enabling 2FA for Users Requires password verification. Returns TOTP URI (for QR code) and backup codes. twoFactorEnabled is not set to true until first TOTP verification succeeds. Override with skipVerificationOnEnable: true (not recommended). TOTP (Authenticator App) Displaying the QR Code Verifying TOTP Codes Accepts codes from one period before/after current time: TOTP Configuration Options OTP (Email/SMS) Configuring OTP Delivery Sending and Verifying OTP Send: authClient.twoFactor.sendOtp(). Verify: authClient.twoFactor.verifyOtp({ code, trustDevice: true }). OTP Storage Security Configure how OTP codes are stored in the database: For custom encryption: Backup Codes Generated automatically when 2FA is enabled. Each code is single-use. Displaying Backup Codes Regenerating Backup Codes Invalidates all previous codes: Using Backup Codes for Recovery Backup Code Configuration Handling 2FA During Sign-In Response includes twoFactorRedirect: true when 2FA is required: Sign-In Flow 1. Call signIn.email({ email, password }) 2. Check context.data.twoFactorRedirect in onSuccess 3. If true, redirect to /2fa verification page 4. Verify via TOTP, OTP, or backup code 5. Session cookie is created on successful verification Server-side: check "twoFactorRedirect" in response when using auth.api.signInEmail. Trusted Devices Pass trustDevice: true when verifying. Default trust duration: 30 days (trustDeviceMaxAge). Refreshes on each sign-in. Security Considerations Session Management Flow: credentials → session removed → temporary 2FA cookie (10 min default) → verify → session created. Rate Limiting Built-in: 3 requests per 10 seconds for all 2FA endpoints. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills better-auth/twoFactor