marko / authentication-two-factor

0.13.0 2026-11-03 18:25 UTC

Requires

• php: ^8.5
• marko/authentication: 0.13.0
• marko/clock: 0.13.0
• marko/config: 0.13.0
• marko/core: 0.13.0
• marko/ratelimiter: 0.13.0
• marko/routing: 0.13.0
• spomky-labs/otphp: ^11.3

Requires (Dev)

• marko/cache-array: 0.13.0
• marko/testing: 0.13.0

MIT

Published on Packagist.org on 2026-11-03 19:14 UTC

README

Two-factor authentication for Marko --- TOTP codes from any authenticator app, single-use recovery codes, and a login challenge that holds password logins until the code is entered.

Installation

composer require marko/authentication-two-factor

Quick Example

use Marko\AuthenticationTwoFactor\Contracts\TwoFactorManagerInterface;
use Marko\AuthenticationTwoFactor\TwoFactorChallenge;

// Setup: show the QR code (otpauth URI) and recovery codes once
$setup = $twoFactorManager->enable($user, label: $user->email);
$twoFactorManager->confirm($user, $codeFromApp);

// Login: with TwoFactorLoginChallenge on the guard, attempt() holds the user
if (!$authManager->attempt($credentials) && $twoFactorChallenge->isPending()) {
    // ...show the code form, then:
    $twoFactorChallenge->verify($submittedCode);
}

Documentation

Full usage, API reference, and examples: marko/authentication-two-factor