How do I set up MFA for user accounts in my app?

To set up MFA for user accounts, the usual pattern is:

1) Choose MFA methods

Common options:

• TOTP authenticator apps (Google Authenticator, Authy, Microsoft Authenticator) — good default
• SMS — easier but less secure
• Email OTP — simple, but weaker than TOTP
• Passkeys / WebAuthn — strongest modern option
• Backup codes — important for account recovery

If you’re starting out, TOTP + backup codes is a solid baseline.

---

2) Add MFA fields to your user model

Typical fields:

• mfa_enabled: boolean
• mfa_method: string (e.g. totp, sms, webauthn)
• mfa_secret_encrypted: string (for TOTP seed or similar, encrypted at rest)
• mfa_verified_at: datetime
• backup_codes_hashed: array/string
• mfa_phone_number: string (if using SMS)

---

3) MFA enrollment flow

For TOTP, the common flow is:

1. User logs in with password
2. User enables MFA in account settings
3. Server generates a secret
4. Server shows a QR code or provisioning URI
5. User scans it in an authenticator app
6. User enters a 6-digit code to confirm setup
7. If code is valid, set mfa_enabled = true

Important:

• Don’t activate MFA until the user successfully verifies the code.
• Encrypt the secret before storing it.
• Store backup codes once, ideally hashed.

---

4) Login flow with MFA

Typical login sequence:

1. User submits username + password
2. If password is valid and MFA is enabled:
   • create a temporary “MFA pending” session/token
   • ask for the second factor
3. User submits MFA code
4. Verify it
5. If valid, complete login and issue the real session/JWT

Do not issue a full authenticated session until MFA passes.

---

5) Verify codes securely

For TOTP:

• Use a standard library, not custom crypto
• Allow a small clock drift window, like ±1 time step
• Rate-limit attempts
• Prevent brute force with lockouts or throttling

---

6) Handle recovery

You should provide:

• Backup codes
• MFA reset flow
• Optional admin support process for lost-device recovery

Make sure reset flows are secure:

• require reauthentication
• use email confirmation or existing session checks
• log the event

---

7) Protect sensitive operations

Even after login, consider requiring MFA again for:

• changing password
• disabling MFA
• changing email
• exporting data
• payout / payment actions
• adding new authentication methods

This is often called step-up authentication.

---

8) Recommended implementation details

• Store MFA secrets encrypted with a server-side key management system
• Hash backup codes like passwords
• Rate-limit MFA verification endpoints
• Log setup/disable/recovery events
• Support one-time recovery codes
• Prefer passkeys/WebAuthn if you want stronger security

---

9) Example user experience

• Settings page: “Enable MFA”
• User scans QR code
• Enters 6-digit code
• Gets backup codes to save
• Next login: password → MFA code → app access

---

10) If you want a quick tech stack example

I can give you a sample implementation for:

• Node.js / Express
• Python / Django / FastAPI
• Ruby on Rails
• Java / Spring
• .NET
• React + API backend

If you tell me your stack, I can show you the exact database schema and code flow.