Adding supplementary 2FA methods to WP 2FA

WP 2FA supports several authentication and two-factor authentication methods, with the available options depending on your WP 2FA edition. These include:

• One-time code via a 2FA app (TOTP) – users generate a code with an authenticator app.
• One-time code via email – users receive a login code at their email address.
• Passkeys – users can sign in using a device, biometric authentication, PIN, or compatible security key.
• Link via email – users authenticate by clicking a link sent to them.
• One-time code via SMS – SMS messages can be sent through Twilio or Clickatell.
• One-time password via YubiKey – users authenticate with a compatible YubiKey.
• Zero-setup one-time code via email – users automatically receive an email code without first configuring their own 2FA method.
• Push notification via Authy – available to existing supported Authy API customers.

Note: Twilio has closed the Authy API to new customers and plans to fully deprecate it in the future. As a result, Authy push notifications are only available to existing supported Authy API customers. If you already use Authy, see our guide to setting up WP 2FA with Authy push notifications for configuration instructions.

WP 2FA also supports several 2FA backup methods. These help prevent users from being locked out if their primary 2FA method becomes unavailable, for example, if their phone runs out of battery.

When to add a supplementary 2FA method

You need a supplementary authentication method when WP 2FA does not already support the authentication method or service you want to use.

For example, your organization might already use an internal authentication system or a third-party authentication provider that you want to make available to your WordPress users.

WP 2FA provides hooks and classes that developers can use to integrate such methods with the plugin.

You can add:

• A primary authentication method, which users can use as their normal 2FA method.
• A secondary or backup authentication method, which users can use when their primary method is unavailable.
• Both a primary and a backup method.

Adding a primary 2FA method

The first part of the developer documentation explains how to add a supplementary primary authentication method.

This includes the hooks you can use to register the method and integrate it with WP 2FA.

Not every hook is required for every integration. Which hooks you need depends on how your authentication method works.

Adding a backup 2FA method

The documentation also explains how to add a supplementary backup authentication method.

Before developing your own backup method, you may also want to review the backup methods already available in WP 2FA.

WP 2FA developer resources

Depending on your integration, you may also find the following documentation useful.

• If you need to validate authentication codes from supported token-based 2FA methods, see the WP 2FA REST API documentation.
• If you are working with passkeys or WebAuthn, see the WP 2FA Passkeys REST API documentation.
• For a complete list of available hooks, see the WP 2FA hooks reference.

Adding a custom authentication method requires PHP and WordPress development experience. Depending on the integration, you may also need experience with the API or SDK of the authentication service you are using.

If you need help with WP 2FA or have questions about the available integration options, open a support ticket to get in touch with us.