Two-Factor Authentication

Overview

XLogin supports TOTP (Time-based One-Time Password), compatible with Google Authenticator, Authy, Microsoft Authenticator, and any TOTP app.

Enable it in config:

two-factor:
  enabled: true

Setup Flow

1. Player runs /2fa setup. XLogin generates a random TOTP secret (Base32 encoded).
2. Player adds the secret to their authenticator app.
3. Player runs /2fa <code> with the 6-digit code from the app.
4. If valid, 2FA is enabled on the account.

Login with 2FA

After entering the correct password with /login, the player is prompted to enter their 2FA code:

/2fa <code>

The code is validated against the stored secret using HMAC-SHA1 with a ±30 second tolerance window (checks time-1, time, and time+1).

Backup codes

Eight single-use codes, shown once at setup and stored hashed exactly as a password is. A lost phone would otherwise mean a lost account, and the alternative — staff disabling 2FA on request — is the social-engineering path that makes 2FA worth bypassing in the first place.

/2fa codes            # issue a set, shown once
/2fa recover <code>   # use one when the device is gone

Each code works once. Running /2fa codes again issues a fresh set and voids the old one. This is what keeps an administrator out of the database when somebody changes phone.

Disabling 2FA

/2fa disable

Must be authenticated. Removes the secret from the database.