Payload CMS 2FA
Secure your Payload CMS application with TOTP-based two-factor authentication.
Payload CMS 2FA
Add secure two-factor authentication to Payload CMS with a simple, self-hosted plugin built to work with Payload's native authentication system.
Payload CMS 2FA provides TOTP authentication, QR-code setup, backup codes, protected login, and a dedicated Admin Panel experience without replacing your existing authentication setup.
Use Payload CMS 2FA with the default users collection or any
authentication-enabled collection you configure.
Get Started
Overview
Learn how Payload CMS 2FA works and what it adds to your application.
Installation
Install the plugin, configure the required secret, and generate the import map.
Quick Start
Enable 2FA for a user and complete your first protected login.
Configuration
Configure your authentication collection and TOTP issuer.
Built for Payload CMS
Payload CMS 2FA is designed to fit into the authentication system you already use.
Native Authentication
Works with Payload CMS authentication instead of replacing it with a separate system.
Protected Login
Require two-factor verification when 2FA is enabled for a user.
Recovery Codes
Give users backup codes for account recovery when their authenticator is unavailable.
Custom Collections
Use an existing authentication collection with a configurable collection slug.
Configurable Issuer
Choose the service name displayed by users' authenticator applications.
Self-Hosted
Keep authentication and two-factor verification inside your own Payload application.
Authentication
The plugin supports the complete two-factor authentication flow:
- Email and password authentication
- TOTP verification through an authenticator application
- Backup code verification
- Protected API login when 2FA is enabled
- Normal authenticated API access after login
When 2FA is enabled, authentication must be completed through the Payload 2FA login flow. Authenticated API requests continue to work normally.
Requirements
- Payload CMS 3.x
- A supported Node.js version
- An authentication-enabled Payload collection
- A TOTP-compatible authenticator application
Last updated on