Production-ready 2FA auth architecture
Multi-Factor Authentication
Multi-Factor Authentication is an educational and production-grade auth architecture demo implemented in Node.js, Express, and Vanilla JS. It demonstrates a complete identity security lifecycle: email verification via 4-digit OTP, multi-method 2FA (email OTP, TOTP 6-digit authenticator app, and 10 single-use backup recovery codes), secure password reset workflows, and account settings. The backend features a resilient multi-tier delivery chain (Brevo HTTPS API → SMTP relay → Instructor Debug fallback), rate limiting with retry headers, and smart UX guards for username collisions.
Problem
Authentication guides often oversimplify 2FA, leaving out critical real-world edge cases like SMTP blocking on cloud hosts, recovery codes for lost authenticator devices, and rate-limiting cooldowns.
Solution
A comprehensive, fully functional auth reference architecture combining email OTP, TOTP apps, single-use backup codes, multi-tier email provider fallbacks, and resilient password reset loops.
Outcome
A deployed, testable identity security showcase demonstrating full-stack Node.js development, cryptographic TOTP orchestration, transactional email delivery pipelines, and defense-in-depth access controls.
Standout Features
- Multi-method 2FA: Email OTP (4 digits), Authenticator app (TOTP 6 digits), and 10 single-use backup recovery codes
- Multi-tier email delivery pipeline: Brevo HTTPS API → SMTP relay → Instructor debug mode fallback
- Complete auth lifecycle: signup verification, login, password reset with OTP, profile update, and password changes
- Security UX details: autosuggest dirty guards, OTP resend cooldowns, and API rate limiting
Stack & Signals
- Node.js
- Express
- Vanilla JS
- TOTP / OTP
- Brevo API
- Render
Canonical destination