How do I add MFA to my application users?

To add MFA (multi-factor authentication) for your application users, the basic approach is:

1) Pick the MFA methods you’ll support

Common options:

• TOTP authenticator apps (Google Authenticator, Authy, Microsoft Authenticator) — most common
• SMS codes — easier to implement, but weaker and more costly
• Email codes — simple, but not ideal as a second factor
• Push notifications / passkeys / WebAuthn — strongest and increasingly preferred

If you’re starting out, TOTP + backup codes is a solid baseline.

2) Extend your user model

Add fields like:

• mfa_enabled
• mfa_method
• mfa_secret (for TOTP, store encrypted)
• mfa_verified_at or similar
• backup_codes (store hashed, not plaintext)
• recovery/contact info if needed

3) Add an MFA enrollment flow

Typical flow:

1. User logs in with username/password
2. User goes to “Enable MFA”
3. App generates a secret / registration challenge
4. User scans QR code or approves device
5. User enters a code to confirm setup
6. You mark MFA as enabled

For TOTP:

• Generate a shared secret
• Show it as a QR code
• Ask the user to enter the 6-digit code from their app
• Verify it before enabling MFA

4) Add MFA to login

After password verification:

1. Check whether the user has MFA enabled
2. If yes, don’t issue full session yet
3. Prompt for second factor
4. Verify the second factor
5. Then complete login and create the authenticated session/JWT

This is often implemented as a two-step auth state:

• password_verified
• mfa_verified

5) Add recovery and fallback options

Users will lose devices, so include:

• Backup/recovery codes
• Admin reset process
• Optional account recovery through verified email/support workflow

Store recovery codes hashed, and mark each code as used after validation.

6) Secure it properly

Important practices:

• Use TLS/HTTPS
• Encrypt MFA secrets at rest
• Rate limit MFA attempts
• Prevent replay attacks for OTPs
• Require re-authentication for changing MFA settings
• Log MFA events for audit/security monitoring
• Don’t rely on SMS as your only factor if stronger options are available

7) Consider using an identity provider

If you don’t want to build this yourself, use:

• Auth0
• AWS Cognito
• Okta
• Firebase Auth
• Azure AD B2C
• Or an open-source IAM solution like Keycloak

This is often the fastest and safest route.

8) If using TOTP, the implementation pieces are

• Secret generation
• QR code generation
• OTP verification with time window tolerance
• Clock skew handling
• Secret storage encryption
• Backup codes

---

If you want, I can also give you:

1. a step-by-step design,
2. database schema examples, or
3. code samples in your stack (Node.js, Python, Java, .NET, etc.).