Twilio: user MFA via Verify (SMS/WhatsApp/email second factor)

Shipped· 5 months ago

Optional second-factor authentication on /app/account/settings. Users enroll a phone number; Twilio Verify (use the twilio-verify-send-otp skill) issues OTPs over SMS, WhatsApp, or voice depending on user preference and channel availability. TOTP (authenticator app) supported as an offline alternative via the Verify Factors API.

Per-org policy on /app/{org}/settings: "Require MFA for owners and admins" toggle. Recovery codes generated on enrollment, downloadable once. Failed-attempt rate limiting via Verify built-ins. Schema: user_mfa_factors (user_id, factor_type, twilio_sid, last_verified_at, status). Out of scope: org-wide SSO/SAML (existing login_sso settings), passkeys (separate card later).

Comments (2)

Elsama· 8 days ago
Update: SMS MFA enrolment ships (migration 0121). Account → Security can send/confirm a Twilio Verify code and store an encrypted phone when TWILIO_VERIFY_SERVICE_SID + AI_KEY_ENCRYPTION_SECRET are set. Post-login challenge gate before /app remains planned - leaving this card Planned until that lands.
Elsama· 8 days ago
Marked Shipped: enrolment + /login/mfa step-up cookie gate for /app when mfa_sms_enabled. Needs TWILIO_VERIFY_SERVICE_SID on the VM to actually send codes. Follow-ups: org-required MFA policy, recovery codes, WhatsApp/voice channels.

Join the discussion