PHPackages elliot-sawyer/totp-authenticator - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. elliot-sawyer/totp-authenticator ActiveSilverstripe-vendormodule[Authentication & Authorization](/categories/authentication) elliot-sawyer/totp-authenticator ================================ Enable 2FA authentication with TOTP 0.0.2(8y ago)511.8k1[11 issues](https://github.com/elliot-sawyer/totp-authenticator/issues)[1 PRs](https://github.com/elliot-sawyer/totp-authenticator/pulls)BSD-3-ClausePHP Since Feb 16Pushed 7y ago3 watchersCompare [ Source](https://github.com/elliot-sawyer/totp-authenticator)[ Packagist](https://packagist.org/packages/elliot-sawyer/totp-authenticator)[ RSS](/packages/elliot-sawyer-totp-authenticator/feed)WikiDiscussions master Synced today READMEChangelogDependencies (5)Versions (5)Used By (0) [![Code Coverage](https://camo.githubusercontent.com/1554f781d56fd89966aeb1cf6cdda1cef3d057b54616d32b5d165385b778fca8/68747470733a2f2f7363727574696e697a65722d63692e636f6d2f672f656c6c696f742d7361777965722f746f74702d61757468656e74696361746f722f6261646765732f636f7665726167652e706e673f623d6d6173746572)](https://scrutinizer-ci.com/g/elliot-sawyer/totp-authenticator/?branch=master)[![Scrutinizer Code Quality](https://camo.githubusercontent.com/3df079df2f9f52b7167c92c7c7969502b709890d31c84ee293efcebdad541b72/68747470733a2f2f7363727574696e697a65722d63692e636f6d2f672f656c6c696f742d7361777965722f746f74702d61757468656e74696361746f722f6261646765732f7175616c6974792d73636f72652e706e673f623d6d6173746572)](https://scrutinizer-ci.com/g/elliot-sawyer/totp-authenticator/?branch=master) SilverStripe TOTP (Time-based One Time Password) Authenticator ============================================================== [](#silverstripe-totp-time-based-one-time-password-authenticator) This is a time-based token authenticator for SilverStripe. It allows users with apps such as Google Authenticator or Authy to generate a code to be used for logging into a SilverStripe installation. Backup codes are also available to the user, in case their second factor is lost, stolen, or otherwise unavailable. This extends and builds from Firesphere's MFABootstrap module, and has been tested with a vanilla installation of CWP 2.0 and SilverStripe 4.1.1 Supported Authenticators ------------------------ [](#supported-authenticators) It is difficult to support an exhaustive list of authenticator apps, but for the purposes of an initial release the following authenticators are supported. - Google Authenticator - Authy If you know of any others that can be added to this list, raise a pull request along with any code and unit tests you've added to ensure support. Installation ------------ [](#installation) `composer require elliot-sawyer/totp-authenticator` Configuration ------------- [](#configuration) Add the following to config.yml ``` SilverStripe\Security\Member: extensions: - ElliotSawyer\TOTPAuthenticator\MemberExtension SilverStripe\Core\Injector\Injector: SilverStripe\Security\Security: properties: Authenticators: totpauthenticator: %$ElliotSawyer\TOTPAuthenticator\TOTPAuthenticator ``` ### Algorithms [](#algorithms) Google Authenticator and Authy only support tokens generated with SHA-1. Other authenticators MAY implement SHA-256 or SHA-512 as outlined in [RFC6238](https://tools.ietf.org/html/rfc6238). You may use the Config API to adjust this algorithm if you need to support a specific TOTP authenticator ``` ElliotSawyer\TOTPAuthenticator\TOTPAuthenticator: algorithm: 'sha512' ``` Usage ----- [](#usage) 1. Login to CMS as usual, taking care to use the "default" authenticator. Visit the Security admin and select your user. Ignore the TOTPSecret field for now. Tick the "MFA Enabled" and “Reset MFA codes” and save the Member. 2. Take note of your backup tokens, as they can be used to log into your account if the authenticator is lost, stolen, or otherwise unavailable. These are stored encrypted in the database and are not recoverable. They must be reset if lost. 3. Return to Main tab and reveal the “Second Factor Token Secret. Scan the QR code with Google Authenticator or Authy. Your website name ( as defined by Site title) and your username are visible at the end of Google Authenticator. 4. Visit to log in. You will be prompted for your second factor access code. TODO ---- [](#todo) Please raise issues and feature requests at ### Health Score 27 — LowBetter than 49% of packages Maintenance0 Infrequent updates — may be unmaintained Popularity25 Limited adoption so far Community15 Small or concentrated contributor base Maturity56 Maturing project, gaining track record Bus Factor2 2 contributors hold 50%+ of commits How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 2 Last Release 3007d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/ad627a2d8fe16725eb7c9cdde9f4e92e26bf3fbf4c5baf3b9eebca58c8168941?d=identicon)[0x0000](/maintainers/0x0000) --- Top Contributors [![elliot-sawyer](https://avatars.githubusercontent.com/u/354793?v=4)](https://github.com/elliot-sawyer "elliot-sawyer (12 commits)")[![robbieaverill](https://avatars.githubusercontent.com/u/5170590?v=4)](https://github.com/robbieaverill "robbieaverill (10 commits)")[![silverstripe-elliot](https://avatars.githubusercontent.com/u/5863816?v=4)](https://github.com/silverstripe-elliot "silverstripe-elliot (6 commits)")[![ScopeyNZ](https://avatars.githubusercontent.com/u/3260989?v=4)](https://github.com/ScopeyNZ "ScopeyNZ (2 commits)")[![Firesphere](https://avatars.githubusercontent.com/u/680570?v=4)](https://github.com/Firesphere "Firesphere (1 commits)") --- Tags securityAuthenticationsilverstripemodule2-Factor ### Code Quality TestsPHPUnit ### Embed Badge ![Health badge](/badges/elliot-sawyer-totp-authenticator/health.svg) ``` [![Health](https://phpackages.com/badges/elliot-sawyer-totp-authenticator/health.svg)](https://phpackages.com/packages/elliot-sawyer-totp-authenticator) ``` ### Alternatives [silverstripe/mfa Enable multi-factor authentication with fallback codes 10346.1k8](/packages/silverstripe-mfa)[axyr/silverstripe-adminlogin Use a custom login screen to log in to the admin section 165.8k](/packages/axyr-silverstripe-adminlogin)[sicaboy/laravel-mfa A Laravel package of Multi-factor Authentication (MFA/2FA) with a middleware. 101.2k](/packages/sicaboy-laravel-mfa) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)