Two‑factor authentication (2FA) is no longer optional for modern web and mobile applications. Passwords are easy to guess, steal or reuse, and API endpoints are under constant attack (some sources estimate over 90 k attacks on APIs per minute[1]). By adding a second factor—such as a time‑based one‑time password (TOTP), hardware token or...