This app will show you an example of how to build a time-based one-time passcode (TOTP) experience using your favorite authenticator app (like Google Authenticator or Authy) with the Twilio Verify API.

TOTP is a more secure alternative to SMS 2FA and is a popular form of authentication for higher risk users (politicians, celebrities, journalists) or platforms (email, banking).

This sample uses function templates to quickly create and deploy serverless functions you can use to interface with the Twilio Verify API from your production application. The interface provided shows off an example onboarding flow.

How it works:

1. User enters their username
2. App generates a QR code
3. User scans QR code in a compliant authenticator app
4. User enters the correct token
5. App verifies the token and the factor
6. App verifies additional factors on an ongoing basis

For more information, check out:

• What is TOTP?
• Verify TOTP step by step Quickstart
• Verify TOTP technical overview
• How to build TOTP support with the Verify API