Skip to content
πŸ” Two factor authentication package for accounts-password
Branch: master
Clone or download

Latest commit

Fetching latest commit…
Cannot retrieve the latest commit at this time.


Type Name Latest commit message Commit time
Failed to load latest commit information.

Meteor Two Factor

Simple two factor authentication for accounts-password.

Table of Contents


$ meteor add dburles:two-factor


Make sure your project is using Meteor's accounts-password package, if not add it: meteor add accounts-password

Example Application

Simple example application


Client and server usage examples.

Usage (Client)

Typically you would call this method via your application login form event handler:

twoFactor.getAuthCode(user, password, error => {
  if (error) {
    // Handle the error
  // Success!

After calling getAuthCode if you wish, you can request a new authentication code:

twoFactor.getNewAuthCode(error => {
  if (error) {
    // Handle the error
  // Success!

The following method is reactive and represents the state of authentication. Use it to display the interface to enter the authentication code:

Tracker.autorun(function() {
  if (twoFactor.isVerifying()) {
    console.log('Ready to enter authentication code!');

Capture the authentication code and pass it to the following method to validate the code and log the user in:

twoFactor.verifyAndLogin(code, error => {
  if (error) {
    // Handle the error
  // Success!

Usage (Server)

Assign a function to twoFactor.sendCode that sends out the code. The example below sends the user an email:

twoFactor.sendCode = (user, code) => {
  // Don't hold up the client
  Meteor.defer(() => {
    // Send code via email
      to:, // Method attached using dburles:collection-helpers
      from: '',
      subject: 'Your authentication code',
      text: `${code} is your authentication code.`

Optional functions:

// Optional
// Conditionally allow regular or two-factor sign in
twoFactor.validateLoginAttempt = options => {
  return !! options.user.twoFactorEnabled;
// Optional
twoFactor.generateCode = () => {
  // return a random string

Security note:

Use DDPRateLimiter to prevent verification code cracking

import { DDPRateLimiter } from 'meteor/ddp-rate-limiter';

const numberOfAttempts = 5;
const timeInterval = 60;

    type: 'method',
    userId: null,
    clientAddress: null,
    name(name) {
      const methods = [
      return methods.includes(name);
    connectionId() {
      return true;
  timeInterval * 1000


The following functions are attached to the twoFactor namespace. This may change somewhat for Meteor 1.3.

API (Client)


getAuthCode(user, password, [callback])

Generates an authentication code. Once generated, (by default) a twoFactorCode field is added to the current user document. This function mirrors Meteor.loginWithPassword.

user Either a string interpreted as a username or an email; or an object with a single key: email, username or id. Username or email match in a case insensitive manner.

password The user's password.

callback Optional callback. Called with no arguments on success, or with a single Error argument on failure.



Generates a new authentication code. Only functional while verifying.

callback Optional callback. Called with no arguments on success, or with a single Error argument on failure.


verifyAndLogin(code, [callback])

Verifies authentication code and logs in the user.

code The authentication code.

callback Optional callback. Called with no arguments on success, or with a single Error argument on failure.



Reactive function that indicates the current state between having generated an authentication code and awaiting verification.



Call this function while verifying if you wish to allow the user to sign in again.

callback Optional callback. Called with no arguments on success, or with a single Error argument on failure.

API (Server)


sendCode(user, code)

This function is called after getAuthCode is successful.

user The current user document.

code The generated authentication code.


twoFactor.options.fieldName = 'customFieldName';

Specify the name of the field on the user document to write the authentication code. Defaults to twoFactorCode.

validateLoginAttempt (Optional)


If defined, this function is called within an Accounts.validateLoginAttempt callback. Use this to allow regular login under certain conditions.

generateCode (Optional)

If defined, this function is called to generate the random code instead of the default.



You can’t perform that action at this time.