# Two-factor authentication (2FA) · Add a second factor with Bird Verify

**✦ Verification flow •••**

Your account

Confirm it’s you.

Enter the code sent to

Example verification code

Code verified

Send a code. Confirm the recipient.

## 2FA is the verification flow, pointed at login.

Under the hood, 2FA is the same flow the [Bird Verify API](/verify-api) runs everywhere: create a verification for the user's phone or email when they sign in, then check the code they enter. Because the check is by recipient, your login handler keeps no per-attempt state, and the workspace's routing decides which channel a given user gets. Drop the password in front of it and the same flow becomes [passwordless login](/verify-api/features/passwordless).

## What you wire up for 2FA.

Two calls and a configuration.

- **01** Send on login, check on submit. Create a verification when the user authenticates with their first factor; check the code when they enter it. That's the whole integration.
- **02** SMS, WhatsApp, or email as the factor. Use the channel you already have for the user: a phone number over SMS or WhatsApp, an email over email. Voice is rolling out for more options.
- **03** One configuration, workspace-wide. Routing, code rules, and channel plan live in a single configuration for the whole workspace, already covering login, signup, and high-value actions.
- **04** Brute force is bounded. Attempt lockout and per-recipient send caps come built in, so a second factor doesn't become a new attack surface.

## The login-time flow.

Send the code once the password checks out; verify it when the user submits. A wrong code is a result you branch on, not an exception to catch.

**two-factor.ts**

```typescript
// Send the second factor once the password checks out.
await bird.verify.verifications.create({
  to: { phone_number: user.phone },
}).safe();

const { data, error } = await bird.verify.verifications.check({
  to:   { phone_number: user.phone },
  code: submitted,
}).safe();
if (error) throw error;

if (data.success) grantSession(user);
```

## Build it on the Verify platform

The channels and controls behind your 2FA flow.

- [SMS OTP](/verify-api/features/sms): The most common second factor: a code texted to the user's phone.
- [Email OTP](/verify-api/features/email): A second factor for users you reach by email, no phone required.
- [Channel orchestration](/verify-api/features/orchestration): Per-country channel order and senders, resolved automatically and tunable per request.
- [Anti-abuse & code security](/verify-api/features/security): Attempt lockout, send caps, and hashed codes that keep 2FA safe.
- [Verify API overview](/verify-api): The full Verify API: create-or-retry, check by target, and advance to the next channel.

## Scale without  losing control.

Organize teams in workspaces, control API access, and trace changes through audit logs.

Harbor Organization
Workspaces Production Sandbox

### Delivery agent

API key · Customer operations team
Active
Permissions Access
Email Read & write
SMS Read & write
WhatsApp Read Read & write
AL Alex Lee Admin  Permissions updated

### Audit log

Production
 API key updated Alex Lee · 09:42:18 UTC

Workspace
Production

Resource
Delivery agent

WhatsApp
Read Read & write

Succeeded

 [Workspaces](/docs/guides/workspaces)[Team roles](/docs/guides/users-teams-roles)[API authentication](/docs/guides/authentication)
[Explore Enterprise](/enterprise)

## Start with Verify. Build across channels with Bird.

[Get started](/dashboard/signup?returnTo=%2Fdashboard%2Fw%2Fverify) · [Contact Sales](/demo?product=verify)

[Email](/email-api) · [SMS](/sms-api) · [WhatsApp](/whatsapp-api) · [Apple Messages](/apple-messages-api) · [Voice](/voice-api)



## Related resources

- [Verify phone numbers at signup](/learn/series/verify-phone-numbers-at-signup) (video)
- [Verify your first customer](/docs/get-started/verify-your-first-customer) (docs)
- [What does OTP mean? One-time passwords explained](/explained/verify/what-does-otp-mean) (answer)
- [Build your first integration](/learn/paths/integration) (course)

[Get an implementation brief](/learn/workspace?topic=verify)