scheb/2fa-totp

scheb/2fa-totp adds TOTP (Time-based One-Time Password) two-factor authentication to Symfony applications. It is a provider package for the scheb/2fa authentication bundle, plugging into its two-factor flow so users can confirm logins with codes generated by authenticator apps like Google Authenticator, Authy, or 1Password.

The package implements the RFC 6238 TOTP standard on top of spomky-labs/otphp, exposing interfaces your user entity implements to store a TOTP secret and configuration. It handles QR-code provisioning URIs, code validation, and integration with Symfony’s security layer, while the parent scheb/2fa bundle manages the surrounding authentication workflow.

What You Get

• A TOTP two-factor provider that integrates with the scheb/2fa Symfony bundle
• Model interfaces (TwoFactorInterface, TotpConfigurationInterface) for storing a user’s TOTP secret and settings
• A TotpAuthenticator built on spomky-labs/otphp implementing RFC 6238
• Provisioning-URI generation for QR codes used to enroll authenticator apps
• Symfony validator constraints for verifying submitted TOTP codes

Common Use Cases

• Adding authenticator-app-based two-factor login to a Symfony application
• Enrolling users by generating a QR code from a TOTP provisioning URI
• Validating time-based one-time codes during the Symfony authentication flow

Under The Hood

Architecture - The package is split into a Model/Totp/ layer (TwoFactorInterface, TotpConfiguration, and their interfaces) that user entities implement to hold TOTP state, and a Security/TwoFactor/ layer providing TotpAuthenticator, a TotpAuthenticatorTwoFactorProvider that hooks into the scheb/2fa bundle’s provider chain, event definitions, and Symfony validator constraints (UserTotpCode/UserTotpCodeValidator) for verifying submitted codes. Tech Stack - PHP 8.4/8.5, depending on scheb/2fa-bundle (pinned to self.version within the monorepo) and spomky-labs/otphp for the RFC 6238 TOTP implementation and provisioning URIs. Code Quality - Developed in the scheb/2fa monorepo with shared CI (GitHub Actions), Codecov coverage, strict typing, and interface-driven design; each provider package is small, focused, and covered by the monorepo test suite. API Design - Integration is declarative: implement the TOTP interfaces on your user, register the provider through the bundle configuration, and the authenticator handles code generation, provisioning URIs, and validation. The learning curve comes from the broader scheb/2fa bundle setup rather than this package itself.