A comprehensive guide and skill for implementing secure multi-factor authentication using the Better Auth framework and its twoFactor plugin.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install twofactor
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install twofactor using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Better Auth Two-Factor Authentication Implementation?
This skill provides the technical foundation for integrating two-factor authentication (2FA) into applications powered by Better Auth. It covers the full lifecycle of identity verification, from initial server-side configuration to client-side redirection and verification UI logic. By leveraging this implementation via Openclaw Skills, developers can deploy industry-standard security measures including TOTP authenticator support and fallback OTP methods.
The framework prioritizes security by ensuring that 2FA is only considered active once a user successfully verifies their first code, preventing lockout scenarios caused by misconfiguration. It also manages complex states like temporary 2FA session cookies and trusted device persistence, allowing for a balance between high security and user convenience.
Better Auth Two-Factor Authentication Implementation Use Cases
- Protecting user accounts from unauthorized access by requiring a second form of verification.
- Implementing TOTP-based security compatible with apps like Google Authenticator or Microsoft Authenticator.
- Providing SMS or Email-based one-time passwords for users who prefer non-app-based verification.
- Offering secure account recovery through the generation and management of single-use backup codes.
- Reducing friction for returning users by implementing trusted device 'remember me' functionality.
How Better Auth Two-Factor Authentication Implementation Works
- The developer configures the twoFactor plugin within the Better Auth server instance, defining issuers and security parameters.
- Database schemas are updated via the CLI to store encrypted secrets, backup codes, and 2FA status.
- On the client side, the application is configured to detect a 2FA requirement during the sign-in process and redirect the user accordingly.
- When a user enables 2FA, they are presented with a TOTP URI or OTP challenge which must be verified to finalize the setup.
- During subsequent logins, the system checks the user's 2FA status and issues a temporary 2FA cookie if verification is required.
- Upon successful verification of a code or backup string, the temporary session is upgraded to a full authenticated session.
Better Auth Two-Factor Authentication Implementation Setup
To begin using this skill, install the core Better Auth packages and configure your server. First, run the migration tool to update your database:
npx @better-auth/cli migrate
Next, register the plugin in your authentication configuration:
import { betterAuth } from "better-auth";
import { twoFactor } from "better-auth/plugins";
export const auth = betterAuth({
plugins: [twoFactor({ issuer: "YourAppName" })]
});
Better Auth Two-Factor Authentication Implementation Data Schema & Taxonomy
The implementation manages several key data points to ensure secure authentication flows. Openclaw Skills recommends reviewing the following metadata structure:
| Property | Description | Storage Type |
|---|---|---|
twoFactorEnabled |
Indicates if the user has completed 2FA setup. | Boolean |
totpSecret |
The secret key used for generating TOTP codes. | Encrypted String |
backupCodes |
A list of single-use recovery strings. | Encrypted Array |
trustedDevices |
Records of verified devices and their expiry. | JSON/Table |
otpCode |
The current active one-time password. | Plain/Hashed/Encrypted |
Better Auth Two-Factor Authentication Implementation Advanced Features
- Support for custom encryption hooks to secure TOTP secrets and backup codes at rest.
- Integrated rate limiting to prevent brute-force attacks on 2FA verification endpoints.
- Trusted device management with configurable TTL (Time-To-Live) to skip 2FA on recognized hardware.
- Constant-time comparison for OTP validation to mitigate timing side-channel attacks.
- Flexible OTP delivery architecture allowing integration with any third-party Email or SMS provider.
SKILL.md
Loading
Related Openclaw Skills
Build Session Skill
A structured framework enabling autonomous agents to transition from reactive responses to proactive, productive building and shipping.
Build Session Skill
A productivity framework that transforms autonomous agent idle time into structured sessions for building, researching, and shipping code.
Paper Parse
A sophisticated academic analysis tool that generates both deep technical reports and concise logical summaries for any scientific paper.
Simple HTTP
A lightweight, zero-dependency Node.js HTTP client for making resilient API requests with automatic retries and graceful error handling.
Reflect: AI Agent Self-Improvement
A self-improvement skill that extracts learnings from conversations and permanently encodes them into agent definitions to ensure mistakes are never repeated.
Reflect
Reflect is a self-improvement skill that analyzes conversations to extract learnings and permanently encodes them into agent definitions.
Featured*
