Customer two-factor authentication for Magento 2

SoftwareSilo Customer TFA adds authenticator-app verification to Magento storefront customer accounts. After the normal email and password check, an enrolled customer must enter a current six-digit authenticator code or one unused recovery code before Magento creates the signed-in session.

Customers can enroll from My Account when TFA is optional. When it is mandatory, a customer who has not enrolled is sent through setup during sign-in and cannot use account pages until setup is complete.

Included workflows

Time-based one-time password (TOTP) enrollment by QR code or manual secret.
Verification after regular and AJAX customer login.
Configurable one-time recovery codes.
Recovery-code regeneration after a current TFA code or customer password check.
Customer-initiated disablement when TFA is optional.
Magento Admin status and reset controls with a separate ACL permission.
An optional bypass for Magento's Login as Customer support workflow.

The package protects storefront customer sessions. It does not configure Magento Admin two-factor authentication, send codes by email or SMS, remember trusted devices, or add REST and GraphQL endpoints.

Start here

Configuration is under Stores > Configuration > MageB2B > Customer Two-Factor Authentication.