Two-Factor Authentication

Two-factor authentication (2FA) adds a second step after login. Users turn it on from their settings, choosing an authenticator app (TOTP) or email codes.

Enable in the panel

Calling ->twoFactor() with no builder registers both TotpDriver and EmailDriver. The signature is twoFactor(?string $page = null, ?string $path = null, ?callable $builder = null), so pass the builder as a named argument.

Drivers

Driver	Name	How it works
Laravilt\Auth\Drivers\TotpDriver	totp	Shows a QR code for Google Authenticator, 1Password, Authy and similar apps. Requires confirmation with a first code.
Laravilt\Auth\Drivers\EmailDriver	email	Emails a one-time code at each login.

Custom drivers

Implement Laravilt\Auth\Contracts\TwoFactorDriver (getName(), getLabel(), getIcon(), enable(), verify(), send(), requiresSending(), requiresConfirmation()) and register it:

provider() accepts a class name (resolved from the container) or an instance.

User flow

1. The user opens Settings > Two-Factor (/admin/settings/two-factor), picks a method and confirms it.
2. Recovery codes are generated when 2FA is confirmed. They can be regenerated from the same page.
3. At the next login, the user is redirected to /admin/two-factor/challenge. A lost device can be bypassed at /admin/two-factor/recovery with a recovery code.

Secrets and recovery codes are stored on the users table (two_factor_secret, two_factor_recovery_codes, two_factor_confirmed_at, two_factor_method, two_factor_enabled). The LaraviltUser trait includes Fortify's TwoFactorAuthenticatable, so Fortify helpers such as $user->recoveryCodes() are available. Use $user->hasTwoFactorEnabled() to check the status.

Events

TwoFactorEnabled, TwoFactorDisabled, TwoFactorChallengeSuccessful and TwoFactorChallengeFailed. See Events.

Related

• Passkeys
• User Model