{
  "id": 1985803,
  "title": "Add Google Authenticator 2FA to your Node app in two steps",
  "url": "https://urgent.news/2026/08/19/add-google-authenticator-2fa-to-your-node-app-in-two-steps",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-19T17:33:56.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/amansoomro062/add-google-authenticator-2fa-to-your-node-app-in-two-steps-3n3n"
  },
  "original_language": "en",
  "account": "Adding two-factor authentication (2FA) to a Node.js app might seem daunting, as it often requires delving into RFC documents. Fortunately, the 2fa-kit library simplifies the process into just two steps.\n\nIn the first step, enrollment involves generating a secret, displaying it as a QR code, and securely storing it. To accomplish this, you need to import the necessary functions from the 2fa-kit library and initialize a vault using the master key. Generate the secret, build a verification URI with the user's email, secret, and issuer, and optionally render the URI as a QR code or display the secret for manual entry. After generating the secret, encrypt it along with the salt, and save both the encrypted secret and salt on the user record.\n\nDuring the second step, verification occurs when a user attempts to log in. Import the verifyTotpWithDelta function from 2fa-kit, decrypt the stored secret using the salt associated with the user, and compare the provided code with the generated one. If the verification fails or the TOTP step doesn't match the stored value, deny access to the user. Update the user's record with the last used TOTP step before granting access.\n\nIt's important to note that this integration works seamlessly with popular TOTP applications like Google Authenticator, Authy, 1Password, and more. The 2fa-kit library also handles a few common mistakes that developers might overlook. Secrets are encrypted at rest, not stored in plaintext in the database, replayed codes are rejected through the step check required by RFC 6238, and backup codes are stored as keyed hashes for cases when users lose their phones.\n\nMoreover, the library supports migrating existing Google Authenticator accounts through their migration QR code, has zero dependencies, and works on various platforms such as Node.js 20+, Bun, Deno, and modern browsers. For more details, visit the official documentation and source code at github.com/amansoomro062/2fa-kit.",
  "summary": "Adding 2FA to an app sounds like a weekend of reading RFCs, so most side projects never get it. I published 2fa-kit to make it two steps. Step 1, enrol: generate a secret, show it as a QR code, store it encrypted. import { createVault , generateSecret , buildUri } from \" 2fa-kit \" ; const vault = await createVault ( process . env . MASTER_KEY ! ); const secret = await generateSecret (); const uri…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}