February 19, 2026 — Two-factor authentication has been the single most requested feature on our roadmap since SyAuth launched. Today it ships: every SyAuth account can enrol a TOTP authenticator and require a one-time code on every sign-in.
Compatible with every TOTP app
We emit a standard otpauth:// URI, so SyAuth works out of the box with Google Authenticator, 1Password, Authy, Aegis, Bitwarden, Yubico Authenticator, and any other app in the ecosystem. Scan the QR code, enter one valid code to confirm, and you're done.
What's enforced at login
After password verification (or magic-link consumption) SyAuth checks whether the account has a confirmed MFA device. If it does, we return a short-lived challenge ticket instead of a session token. The client posts the ticket together with the current 6-digit code to POST /auth/mfa/verify/ and receives the real tokens only on success.
Tickets are single-use: a valid or invalid code both burn the ticket. Brute-forcing a leaked ticket offline is not possible.
Built right
- Secrets encrypted at rest. TOTP seeds are stored ciphertext-only using Fernet. A database dump leaks nothing useful without the encryption key.
- ±30 s drift tolerance. Users on slightly skewed clocks don't get locked out.
- Full audit trail. Every enrollment, confirmation, disable, success and failure is immutable-logged to your workspace's audit log, with IP address and user agent.
- Forward compatible. The underlying
UserMFADevicetable already models WebAuthn and recovery-code rows, so passkey support slots in without a schema change.
For admins
Enrollment and disablement endpoints are documented on the developer portal. A dashboard page at /security/mfa ships with the release.
No extra charge — MFA is included on every SyAuth plan including the free tier.