2FA Kit - PHP Email, SMS and Authenticator Login

A drop-in two-factor authentication kit for PHP and MySQL. Let users sign in with a one-time code by email, by SMS, or with an authenticator app like Google Authenticator, Authy, or the bundled Vaultcode app.

Features

• Email login codes that expire and work once
• Optional SMS codes through Twilio or any gateway you choose
• Authenticator app support (RFC 6238 TOTP), with QR code enrollment
• Vaultcode, a companion authenticator web app included in the kit
• Rate limiting and lockout after repeated wrong codes
• Encrypted secrets and hashed codes, nothing stored in plain text
• Clear PHP functions to call from your own login flow, or a ready JSON API
• Full setup guide and a self-test script included

Requirements

PHP 8.0 or later with the OpenSSL extension, MySQL or MariaDB. SMS requires your own provider account, such as Twilio. Email requires your own mail server or SMTP account.

Instructions

INSTALLATION

1. Requirements    - PHP 8.0 or later with the OpenSSL extension    - MySQL or MariaDB    - A web server (Apache/Nginx) or XAMPP for local testing

2. Upload the files    Copy the whole folder to your server or to htdocs (XAMPP).

3. Create the database    - Create a new, empty database.    - Import schema.sql into it (phpMyAdmin: Import tab, choose the file).

4. Edit config.php    - db.dsn: set dbname to the database you just created.    - secret: replace CHANGE_ME_TO_A_LONG_RANDOM_STRING with a long random      string of your own. Never reuse the sample value.      You can generate one with:      php -r "echo bin2hex(random_bytes(32));"    - app_name: your site or app's name (shown in emails and the      authenticator app entry).

5. Turn on email    - Set mail.use_smtp to true.    - Fill in host, port, username, password and encryption with your own      mail provider's SMTP details (your host's mail, Gmail with an app      password, SendGrid, Postmark, Brevo, etc).    - Leave use_smtp as false only if your server already has a working      PHP mail() setup, which is uncommon.

6. Turn on SMS (optional)    - Set sms.enabled to true.    - Set sms.provider to twilio and fill in twilio_sid, twilio_token and      twilio_from (or twilio_messaging_service_sid), OR set provider to      custom and supply your own send function for another gateway.    - Set sms.allowed_prefixes to the countries you want to support, to      control cost and reduce fraud.

7. Test it    - Open index.php in a browser.    - Run php tests/totp_test.php and php tests/phone_test.php from a      command line; every line should say PASS.    - Try each sign-in method once: email, SMS (if enabled), and the      authenticator app (scan the QR code with Google Authenticator,      Authy, or the included Vaultcode app).

8. Connect it to your own login system    Look for the comments marked INTEGRATE in api.php. Replace the sample    login/session code there with your own user lookup and session    handling.

SUPPORT Contact the author through this item's support tab with any setup questions.