two-factor-authentication-best-practices — Claude Code skill: 2FA
Walks an agent through adding two-factor auth to a Better Auth app: TOTP, codes by email or SMS, backup codes, trusted devices.
npx skills add better-auth/skills --skill two-factor-authentication-best-practices -a claude-code
npx skills add better-auth/skills --skill twoFactor -a claude-codeWhat two-factor-authentication-best-practices does
The skill hands the agent the setup order for Better Auth's twoFactor plugin: register it on the server with an issuer, add twoFactorClient() on the client, then run npx auth@latest migrate or generate and push the schema for Drizzle and Prisma. The check at the end is that a twoFactorSecret column now sits on the user table.
From there it covers four flows: TOTP with a QR code, codes sent by email or SMS, single-use backup codes, and remembering a device. Your agent gets the actual calls. twoFactor.enable wants the password, verifyTotp takes a code plus trustDevice, and the sign-in handler watches for twoFactorRedirect before a session is created.
One limit worth knowing before you plan the schema: 2FA can only be turned on for credential accounts. Social-only sign-in sits outside this flow, so decide how those users get through before you build around it.
What it helps with
- add TOTP to an authenticator app and render the QR code
- send one-time codes over email or SMS
- issue backup codes so a lost phone does not lock anyone out
- remember a device between sign-ins
- catch
twoFactorRedirectafter a password sign-in and route to verification
Example prompts for the agent
- Add 2FA to my Better Auth app with the `twoFactor` plugin: TOTP plus backup codes
- Why is no session created after `authClient.signIn.email`? Handle `twoFactorRedirect` and add a `/2fa` page
- Wire OTP delivery through our email helper and store codes hashed
How to install two-factor-authentication-best-practices
1Skills CLI (Vercel)
npx skills add better-auth/skills --skill two-factor-authentication-best-practices -a claude-codenpx skills add better-auth/skills --skill twoFactor -a claude-code2Manually: put the files in place
~/.claude/skills/twoFactor/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/twoFactor/
1Skills CLI (Vercel)
npx skills add better-auth/skills --skill twoFactor -a codex2Manually: put the files in place
.agents/skills/twoFactor/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add better-auth/skills --skill twoFactor -a cursor2Manually: put the files in place
.cursor/skills/twoFactor/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install better-auth/skills twoFactor2Manually: put the files in place
.github/skills/twoFactor/SKILL.md1Skills CLI (Vercel)
npx skills add better-auth/skills --skill twoFactor -a gemini-cli2Platform CLI
gemini skills install https://github.com/better-auth/skills --path better-auth/twoFactorManually: put the files in place
.devin/skills/twoFactor/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add better-auth/skills --skill twoFactor -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
From the same set5
The whole set →Similar
Questions about two-factor-authentication-best-practices
How do I install two-factor-authentication-best-practices in Claude Code?
Run npx skills add better-auth/skills --skill two-factor-authentication-best-practices -a claude-code. The skill lands at ~/.claude/skills/twoFactor/SKILL.md.
What does this skill do?
It documents adding two-factor authentication through Better Auth's twoFactor plugin: TOTP, OTP over email or SMS, backup codes, trusted devices, and the second step during sign-in.
Which accounts can enable 2FA?
Only credential accounts, meaning email and password. That restriction comes from the plugin itself, so plan the sign-in schema with it in mind.
