Not too long ago I wrote about authenticating within a Node.js API using Json Web Tokens (JWT). The basis of the example is around authenticating via a username and password and receiving a JWT for every future request against the API. While that example is incredibly useful and follows best practice, it doesn't cover the scenario where you'd like to have a two-factor authentication (2FA) option for your users. In case you're unfamiliar, 2FA is a second layer of protection for accounts made possible by a time-based token generated by a shared secret key.
We're going to see how to add a two-factor authentication option to our Node.js API while continuing to use Json Web Tokens.