Skip to content

Installation

Jump to bottom
ZL154 edited this page Jun 14, 2026 · 1 revision

Installation

Requires Jellyfin 10.11+ (10.11.9 or newer recommended). The plugin depends on the auth-provider APIs introduced in 10.11. On 10.10.x or older it will not appear in the Catalogue — Jellyfin silently hides plugins whose targetAbi is newer than the server. Check your version under Dashboard → About and upgrade if needed.

Install from the catalogue (recommended)

  1. Open Jellyfin → Dashboard → Plugins → Repositories.
  2. Click + and add this URL: 
    https://raw.githubusercontent.com/ZL154/JellyfinSecurity/main/manifest.json
  3. Save and refresh plugins.
  4. Go to the Catalogue tab → install Jellyfin Security.
  5. Restart Jellyfin.

Upgrades are in-place — every persisted record (TOTP, passkeys, OIDC links, trusted browsers, paired devices, audit history) carries over.

Build from source

# Windows
.\build.ps1 -Install
# Linux/macOS
chmod +x build.sh && ./build.sh --install

build.sh is a fat-package builder: managed assemblies are published once without a RID, then per-RID native libs (linux-x64, linux-arm64, linux-musl-x64) are bundled into runtimes/<rid>/native/ with a copy at the plugin root. This is what makes recovery-code PDF generation work on Raspberry Pi, Apple-Silicon Linux, and Alpine.

Manual install

Copy these files into the plugin directory:

TwoFactorAuth/
├── meta.json
├── Jellyfin.Plugin.TwoFactorAuth.dll
├── Otp.NET.dll
└── QRCoder.dll

If you use OIDC, email OTP, passkeys, or PDF recovery codes, prefer the catalogue install or the fat build — those features pull in additional bundled dependencies (IdentityModel, Fido2NetLib, MaxMind.Db, QuestPDF + native libs) that the 4-file manual copy does not include.

Plugin directory by OS:

Platform Path
Docker /config/plugins/TwoFactorAuth/
Linux ~/.local/share/jellyfin/plugins/TwoFactorAuth/
Windows %LOCALAPPDATA%\jellyfin\plugins\TwoFactorAuth\

Restart Jellyfin after copying.

Verifying the download

Every release ships .md5 and .sha256 files alongside the .zip so you can confirm the artifact wasn't tampered with after upload. Releases are also Sigstore-signed with SLSA build-provenance attestation. See Releases.

Next steps

🔐 Jellyfin Security

🏠 Home

Getting started

Features

Reference

Help

Clone this wiki locally