---
title: "Add a second factor in two calls."
canonical: "https://bird.com/verify-api/features/2fa"
---

# Add a second factor in two calls.

Two-factor authentication adds a second proof on top of a password: a one-time code on a channel the user controls. With Bird Verify it's a send call at the moment of login and a check call when the user types the code back: SMS, WhatsApp, or email today, per-country channel config, and nothing to store between the two.

**✦ Verification flow •••**

Your account

Confirm it’s you.

Enter the code sent to

Example verification code

Code verified

Send a code. Confirm the recipient.

## 2FA is the verification flow, pointed at login.

Under the hood, 2FA is the same flow the [Bird Verify API](/verify-api) runs everywhere: create a verification for the user's phone or email when they sign in, then check the code they enter. Because the check is by recipient, your login handler keeps no per-attempt state, and the workspace's routing decides which channel a given user gets. Drop the password in front of it and the same flow becomes [passwordless login](/verify-api/features/passwordless).

## What you wire up for 2FA.

Two calls and a configuration.

- **01** Send on login, check on submit. Create a verification when the user authenticates with their first factor; check the code when they enter it. That's the whole integration.
- **02** SMS, WhatsApp, or email as the factor. Use the channel you already have for the user: a phone number over SMS or WhatsApp, an email over email. Voice is rolling out for more options.
- **03** One configuration, workspace-wide. Routing, code rules, and channel plan live in a single configuration for the whole workspace, already covering login, signup, and high-value actions.
- **04** Brute force is bounded. Attempt lockout and per-recipient send caps come built in, so a second factor doesn't become a new attack surface.

## The login-time flow.

Send the code once the password checks out; verify it when the user submits. A wrong code is a result you branch on, not an exception to catch.

**two-factor.ts**

```typescript
// Send the second factor once the password checks out.
await bird.verify.verifications.create({
  to: { phone_number: user.phone },
}).safe();

const { data, error } = await bird.verify.verifications.check({
  to:   { phone_number: user.phone },
  code: submitted,
}).safe();
if (error) throw error;

if (data.success) grantSession(user);
```

## Build it on the Verify platform

The channels and controls behind your 2FA flow.

- [SMS OTP](/verify-api/features/sms): The most common second factor: a code texted to the user's phone.
- [Email OTP](/verify-api/features/email): A second factor for users you reach by email, no phone required.
- [Channel orchestration](/verify-api/features/orchestration): Per-country channel order and senders, resolved automatically and tunable per request.
- [Anti-abuse & code security](/verify-api/features/security): Attempt lockout, send caps, and hashed codes that keep 2FA safe.
- [Verify API overview](/verify-api): The full Verify API: create-or-retry, check by target, and advance to the next channel.

## Escale sem perder o controle.

Organize equipes em espaços de trabalho, controle o acesso à API e rastreie alterações nos logs de auditoria.

[Espaços de trabalho](/docs/guides/workspaces)[Funções da equipe](/docs/guides/users-teams-roles)[Autenticação da API](/docs/guides/authentication)
[Explore o Enterprise](/enterprise)

## Start with Verify. Build across channels with Bird.

[Get Started](/dashboard/signup?returnTo=%2Fdashboard%2Fw%2Fverify) · [Contact Sales](/demo?product=verify)

[Email](/email-api) · [SMS](/sms-api) · [WhatsApp](/whatsapp-api) · [Apple Messages](/apple-messages-api) · [Voice](/voice-api)



## Related resources

- [Verify phone numbers at signup](/learn/series/verify-phone-numbers-at-signup) (video)
- [Verify your first customer](/docs/get-started/verify-your-first-customer) (docs)
- [What does OTP mean? One-time passwords explained](/explained/verify/what-does-otp-mean) (answer)
- [Build your first integration](/learn/paths/integration) (course)

[Get an implementation brief](/learn/workspace?topic=verify)