Implement support for optional Two-Factor Authentication (2FA) to enhance account security. Users should be able to enable 2FA from their account settings, using either an authenticator app (TOTP) or email/SMS-based codes.
This feature will allow users who want stronger protection to secure their accounts beyond just a password, while keeping login simple for those who prefer not to enable 2FA.
Acceptance Criteria:
Users can enable/disable 2FA from account settings.
Supported methods: authenticator app (TOTP), email, or SMS.
Login flow prompts for 2FA code if enabled.
Recovery options available if user loses access to 2FA method.
Default behavior: 2FA disabled unless user opts in.
Implement support for optional Two-Factor Authentication (2FA) to enhance account security. Users should be able to enable 2FA from their account settings, using either an authenticator app (TOTP) or email/SMS-based codes.
This feature will allow users who want stronger protection to secure their accounts beyond just a password, while keeping login simple for those who prefer not to enable 2FA.
Acceptance Criteria:
Users can enable/disable 2FA from account settings.
Supported methods: authenticator app (TOTP), email, or SMS.
Login flow prompts for 2FA code if enabled.
Recovery options available if user loses access to 2FA method.
Default behavior: 2FA disabled unless user opts in.