Two Factor Authentication for admin/OAuth2 for REST API I am building a "headless" Drupal application.  The front-end is in AngularJS using OAuth2 to authenticate to the REST API that I have built.  A client did a security audit and wanted additional security on the Drupal administration interface.  I implemented the TFA module using Google Authenticator and Twilio SMS.  All is good.

Except, calls to the API are requiring TFA completion/validation. This is noted in the documentation. It states to develop a custom plugin that will handle web services connections.  

I don't have a problem doing this, but I was wondering if anybody has run into this issue and has the plugin ready for sharing.  I have exhausted plenty of time searching to no avail.
There's no public plugin for this as far as I'm aware of (note, I'm author of the drupal.org TFA module).

I do think it's a quick write, depending somewhat on how your REST API is authenticating the request and particularly whether you create a Drupal session and invoke the user login process.

You can allow a REST call to skip the TFA process very similar to how the TfaTrustedBrowser works. The loginAllowed() method on this plugin (implementing TfaLoginPluginInterface) will be invoked and you can check the request headers/global scope (user UID) and return TRUE to tell TFA to not block the login action.