Freelance › Projects › Web development › Web programming › Build a two-factor authentication (2FA/OTP) service with API
Build a two-factor authentication (2FA/OTP) service with API
Employer
Andriy
Project parameters
Type of cooperationOne-time project
SectionWeb development, Web programming
Prepaymentwithout prepayment
Payment methodsCash, Bank transfer
Acceptance of requestsfrom today, 11:39 until Sep 1, 2026
Project description
We run several web and mobile products and want to stop reinventing account protection in each one. The goal of this project is a single, self-hosted two-factor authentication service that our applications can call over an API to enrol users, issue one-time codes, and verify them at login or during sensitive actions. This is deliberately NOT an SSO or OAuth login-delegation project, and it is not a bare SMS gateway wrapper. What we need is the OTP layer itself: the logic that generates, stores, expires, rate-limits, and validates codes, plus the enrolment and recovery flows around it.
On the method side we want proper TOTP support so users can pair Google Authenticator, Authy, or any RFC-compatible app by scanning a QR code, with a shared-secret provisioning endpoint and clock-drift tolerance. Alongside that we need one-time codes delivered by SMS and by email as fallback channels, with configurable code length, expiry windows, and resend throttling to keep costs and abuse under control. Every enrolled user should receive a set of single-use backup codes they can print or save, and there must be a safe re-issue and revoke path when a device is lost. The delivery layer should be adapter-based so an SMS or email provider can be swapped through configuration rather than code changes.
The whole thing must be driven by a documented REST API with token-based authentication for the calling apps, predictable JSON responses, and clear error codes for wrong, expired, or already-used tokens. Security is the point of the product, so we expect hashed secrets at rest, brute-force lockouts, an audit trail of verification attempts, and sensible defaults out of the box. Please describe your experience with OTP or authentication systems in your proposal.
— TOTP authenticator support (QR provisioning, shared secret, drift tolerance)
— SMS and email one-time codes with expiry and resend throttling
— Single-use backup codes with re-issue and revoke
— Documented REST API with token auth and clear error codes
— Provider adapters for SMS/email, swappable via config
— Audit log, brute-force lockout, hashed secrets at rest
On the method side we want proper TOTP support so users can pair Google Authenticator, Authy, or any RFC-compatible app by scanning a QR code, with a shared-secret provisioning endpoint and clock-drift tolerance. Alongside that we need one-time codes delivered by SMS and by email as fallback channels, with configurable code length, expiry windows, and resend throttling to keep costs and abuse under control. Every enrolled user should receive a set of single-use backup codes they can print or save, and there must be a safe re-issue and revoke path when a device is lost. The delivery layer should be adapter-based so an SMS or email provider can be swapped through configuration rather than code changes.
The whole thing must be driven by a documented REST API with token-based authentication for the calling apps, predictable JSON responses, and clear error codes for wrong, expired, or already-used tokens. Security is the point of the product, so we expect hashed secrets at rest, brute-force lockouts, an audit trail of verification attempts, and sensible defaults out of the box. Please describe your experience with OTP or authentication systems in your proposal.
— TOTP authenticator support (QR provisioning, shared secret, drift tolerance)
— SMS and email one-time codes with expiry and resend throttling
— Single-use backup codes with re-issue and revoke
— Documented REST API with token auth and clear error codes
— Provider adapters for SMS/email, swappable via config
— Audit log, brute-force lockout, hashed secrets at rest
