PHPackages                             aligent/bypass2fa - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. aligent/bypass2fa

ActiveMagento2-module[Security](/categories/security)

aligent/bypass2fa
=================

Magento 2 module for bypassing 2-factor authentication in local development environments.

2.1.1(3y ago)621.1k↓41.7%1Massachusetts Institute of Technology License (MITL)PHPPHP >=7.4

Since Feb 15Pushed 3y ago7 watchersCompare

[ Source](https://github.com/aligent/magento2-bypass-2fa)[ Packagist](https://packagist.org/packages/aligent/bypass2fa)[ RSS](/packages/aligent-bypass2fa/feed)WikiDiscussions main Synced 1mo ago

READMEChangelog (6)Dependencies (2)Versions (9)Used By (0)

Bypass 2-Factor Authentication
==============================

[](#bypass-2-factor-authentication)

This module is designed to allow developers to bypass the need for 2-factor authentication (2FA) in local development environments.

### Configuration

[](#configuration)

The bypassing of 2FA is made possible for both admin access and the generation of admin tokens via API. Both methods of access are controlled by setting variables in the environment's `app/etc/env.php` file:

- `BYPASS_2FA_ADMIN` when set to `true` (must be a boolean, setting truthy or falsy values like 1, 'true' is not supported), this variable allows bypassing of 2FA for admin actions.
- `BYPASS_2FA_API` when set to `true`, this variable allows bypassing of 2FA for admin token generation.

Additionally, there is an added security measure, to prevent 2FA being bypassed accidentally (or intentionally) in production environments. The `app/etc/config.php` file must have the following config setting added under `system => default`:

```
'system' => [
  'default' => [
    'bypass_2fa' => [
      'settings' => [
        'allowed_hostnames' => [
            'hostname1',
            'hostname2',
          ...
        ],
         'allowed_usernames' => [
            'username1',
            'username2'
        ]
      ]
    ]
  ]
]

```

The configured (partial) hostnames are checked against the base URL, with the configured name needing to be contained wholly within the base URL. If no match is found, then 2FA is not bypassed for the request. By committing this setting to the codebase, it prevents someone from overriding the allowed hosts in environments such as Magento Cloud hosting (where `app/etc/config.php` is not writable).

### Magento Cloud

[](#magento-cloud)

Magento Cloud environment-specific variables can be used to switch this feature on and off on a per cloud instance, especially useful for integration environments where emails may not be configured. First make sure that you've added the hostname to `config.php` in the `allowed_hostnames` section, and then also check you've added the usernames in the `allowed_usernames` section that need to be bypassed 2FA when generating the admin tokens. Then, in the Cloud dashboard:

1. Click `Configure enviroment` and enter the `Variables` tab
2. Add `env:BYPASS_2FA_ADMIN` and `env:BYPASS_2FA_API` as needed, setting the value to 1 to enable bypass

###  Health Score

34

—

LowBetter than 77% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity32

Limited adoption so far

Community15

Small or concentrated contributor base

Maturity58

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 63.6% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~175 days

Total

5

Last Release

1218d ago

Major Versions

1.0.0 → 2.0.02022-03-01

1.0.2 → 2.1.02023-01-16

PHP version history (2 changes)1.0.0PHP ^7.3

2.0.0PHP >=7.4

### Community

Maintainers

![](https://www.gravatar.com/avatar/d2562970d9b77564454ead1236c1db5ddedb44198bb00925b614418c4105f541?d=identicon)[aligent](/maintainers/aligent)

---

Top Contributors

[![aligent-lturner](https://avatars.githubusercontent.com/u/40189797?v=4)](https://github.com/aligent-lturner "aligent-lturner (14 commits)")[![gowrizrh](https://avatars.githubusercontent.com/u/40108018?v=4)](https://github.com/gowrizrh "gowrizrh (3 commits)")[![hellboy1975](https://avatars.githubusercontent.com/u/68774?v=4)](https://github.com/hellboy1975 "hellboy1975 (3 commits)")[![harshaaligent](https://avatars.githubusercontent.com/u/80090060?v=4)](https://github.com/harshaaligent "harshaaligent (2 commits)")

---

Tags

developmentmagentomagento2security

### Embed Badge

![Health badge](/badges/aligent-bypass2fa/health.svg)

```
[![Health](https://phpackages.com/badges/aligent-bypass2fa/health.svg)](https://phpackages.com/packages/aligent-bypass2fa)
```

###  Alternatives

[veriteworks/cookiefix

Magento2 extension for Cookie SameSite attribute.

65455.3k1](/packages/veriteworks-cookiefix)[imi/magento2-friendly-captcha

Friendly Captcha integration for Magento2

18116.2k](/packages/imi-magento2-friendly-captcha)[basecom/magento2-csp-split-header

Magento 2 module to split oversized CSP headers into multiple headers.

5256.6k](/packages/basecom-magento2-csp-split-header)[pixelopen/magento-cloudflare-turnstile

Protect your store from spam messages and spam user accounts with Cloudflare Turnstile

5325.4k1](/packages/pixelopen-magento-cloudflare-turnstile)[yireo/magento2-csp-whitelist-inline-js

Magento module to automatically add inline JS script to CSP whitelist

2974.7k](/packages/yireo-magento2-csp-whitelist-inline-js)[sansec/magento2-module-shield

14111.8k](/packages/sansec-magento2-module-shield)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)