Two-Factor Authentication (2FA) Using Speakeasy and Express.
At the root of your project, run the app to make sure everything is working alright:

$ node index.js

And now if we hit the route /api, we receive the following as a JSON response:

Generate Secret Key

We now need to generate a secret key that in turn generates us the two-factor authentication code through the Authenticator extension that we will be using. We will also have a route to register a user containing just the userID and the secret key generated by speakeasy.

To do this we will use Speakeasy’s generateSecret function. The response returns an object that has the secret in ASCII, hex, base32, and otpauth_url formats. We will only be using the base32 string to set up two-factor authentication. Paste the following code to create the register user route:

Right after we add the routes we can now make a POST request to this route to register a user like so:

Now open the Google Authenticator extension/app(this can be installed as an extension) and enter the secret key you just received like so:

Verify the secret

We now have the code generated to us through the secret key by the authenticator app. We now need to verify this code. Notice we have stored the secret as a temporary secret on the storage/database. Only after relevant validation, we can go ahead and store it permanently.

To perform the validation, we need to create another endpoint. The endpoint that verifies the code for us looks something like this:

Now open up the two-factor authentication extension and retrieve the code so we can verify the secret using a Postman request to the verify route.

After the validation, the secret key is now stored permanently and is used to verify future codes.

Verify User Tokens

The final step in the two-factor authentication is verifying the code that the user enters from their authenticator app. We need to add another route that will confirm that the tokens entered by the user are valid. The verification is handled by the Speakeasy TOTP(Time Based One Time Password) verify function.

This receives an object that contains the secret, the encoding to use to verify the token, the token, and a window option. A window refers to the period of time that a token is valid. This is usually 30 seconds but can vary depending on the time selected by the developer of the two-factor process.

You want to be careful to now pass out a large window allowance as that would lead to the verification process becoming less secure. Copy the code below to add the endpoint to validate the tokens.

Now hit the /validate route and verify the code from the authenticator using Postman.

And there you go! We have successfully implemented a two-factor authentication using Speakeasy. We looked into how we can register a user and create a secret shared between your server and the authenticator app; verifying the secret and using it to validate tokens.
[]
['Development', 'Speakeasy', 'Two Factor Authentication', 'Node', 'Expressjs']