title: Adding 2FA to Laravel Passport based API
body: <p>I was kind of surprised that I did not find any practical examples or best practices concerning two-factor authentication for laravel using passport.</p>
  <p>As I would like to implement this step while a user logs in to the API and receives his access token I am not quiet sure how to approach in a secure manner.</p>
  <p>The current process is as follows:</p>
  <ol>
  <li>User sees frontend login page (vue SPA).</li>
  <li>User enters <code>username</code> and <code>password</code> and hits submit.</li>
  <li>SPA sends request to API.</li>
  <li>API responds with access token or gives a not authenticated error if something was wrong.</li>
  <li>SPA can use access token to request other resources from API till token is invalidated.</li>
  </ol>
  <p>As I would like to enable users to activate or deactivate 2FA individually (because some clients might not want to use it, some will), I would add a new column in my <code>users</code> table to store if 2FA is enabled or not.</p>
  <p>But how to continue then? Should the user authenticate with <code>username</code> and <code>password</code> regularly as before, then API knows if he &quot;needs&quot; the second auth step and returns a flag so frontend knows to display another view to enter the token?</p>
  <p>Thankful for any input :)</p>