Two-factor enforcement

Require 2FA for administrators

Require 2FA for all users

Allow backup / secondary method

Require method verification before use

Allowed methods

@php $methods = [ 'security_mfa_method_authenticator' => 'Authenticator app (TOTP)', 'security_mfa_method_passkey' => 'Passkey / WebAuthn', 'security_mfa_method_email' => 'Email OTP', 'security_mfa_method_sms' => 'SMS OTP', 'security_mfa_method_whatsapp' => 'WhatsApp OTP', 'security_mfa_method_telegram' => 'Telegram OTP', 'security_mfa_method_recovery' => 'Recovery codes', 'security_mfa_method_password' => 'Password as step-up (reserved)', ]; @endphp @foreach($methods as $key => $label)

@endforeach

OTP & recovery defaults

OTP length

OTP expiration (minutes)

Max OTP attempts

Max daily OTP requests

Resend cooldown (seconds)

MFA lockout (minutes)

Remember device (days)

Recovery code count

Recovery code length