twofactorThis skill provides guidance and enforcement rules for implementing secure two-factor authentication (2FA) using Better Auth's twoFactor plugin.
Install via ClawdBot CLI:
clawdbot install StevenFengLi/twofactorGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Generated Mar 20, 2026
A fintech app handling sensitive transactions requires robust 2FA to protect user accounts from unauthorized access. Implementing TOTP with authenticator apps ensures secure login, while OTP via email provides fallback verification for password resets. Backup codes offer recovery options in case users lose their devices, maintaining compliance with financial regulations.
A healthcare portal storing personal health information needs strong authentication to safeguard patient data under HIPAA. Using TOTP with configurable digits and periods adds security for medical staff logins, and encrypted OTP storage prevents code exposure. Backup codes allow patients to recover access securely if they misplace their authenticator.
An online marketplace with user accounts and payment details implements 2FA to reduce fraud and enhance trust. TOTP verification with device trust settings improves user experience for frequent shoppers, while OTP via SMS provides quick verification for guest checkouts. Regenerating backup codes helps users maintain account security over time.
A B2B SaaS platform serving multiple organizations uses 2FA to protect corporate data and meet security audits. Configuring TOTP with custom issuers and periods ensures compatibility with company policies, and OTP with email delivery supports remote employee access. The skill's migration and client setup streamline integration into existing authentication flows.
An online learning platform with student and instructor accounts implements 2FA to secure course materials and grades. TOTP setup with QR codes simplifies onboarding for users new to authenticator apps, while OTP with limited attempts prevents brute-force attacks. Displaying backup codes during enrollment encourages students to save them safely.
A SaaS company charges monthly or annual fees for access to its platform, using 2FA as a premium security feature to attract enterprise clients. Enhanced authentication reduces support costs from account breaches and increases customer retention through trust. Revenue is generated from tiered pricing plans that include advanced security options.
A freemium app offers basic 2FA for free users to build a large user base, with advanced features like custom OTP storage or increased backup codes available in paid tiers. This model drives conversions by highlighting security benefits, while monetizing through upgrades for businesses needing compliance. Revenue comes from one-time purchases or premium subscriptions.
A marketplace or payment platform integrates 2FA to secure user transactions and reduce fraud-related losses. By implementing TOTP and OTP verification, the platform minimizes chargebacks and builds user confidence, leading to higher transaction volumes. Revenue is earned as a percentage of each secured transaction processed through the service.
💬 Integration Tip
Start by configuring the twoFactor plugin with default settings, then test TOTP setup with a demo user before enabling OTP or backup codes to ensure smooth deployment.
Scored Apr 19, 2026
Self-hosted auth for TypeScript/Cloudflare Workers with social auth, 2FA, passkeys, organizations, RBAC, and 15+ plugins. Requires Drizzle ORM or Kysely for D1 (no direct adapter). Self-hosted alternative to Clerk/Auth.js. Use when: self-hosting auth on D1, building OAuth provider, multi-tenant SaaS, or troubleshooting D1 adapter errors, session caching, rate limits, Expo crashes, additionalFields bugs.
Clerk integration. Manage Users, Organizations. Use when the user wants to interact with Clerk data.
Clerk auth with API Keys beta (Dec 2025), Next.js 16 proxy.ts (March 2025 CVE context), API version 2025-11-10 breaking changes, clerkMiddleware() options, webhooks, production considerations (GCP outages), and component reference. Prevents 15 documented errors. Use when: API keys for users/orgs, Next.js 16 middleware filename, troubleshooting JWKS/CSRF/JWT/token-type-mismatch errors, webhook verification, user type inconsistencies, or testing with 424242 OTP.
Start and complete WordPress.com OAuth and publish posts through the WordPress.com REST API. Use when you need to generate an authorization URL, exchange cal...
Configures Firebase Authentication — providers, security rules, custom claims, and React auth hooks
Use when auditing Go code involving authentication flows, RBAC policies, Kubernetes admission webhooks, JWT/OAuth token validation, or privilege escalation i...