Files
better-auth/docs/content
Gustavo Valverde be653ab90d docs(two-factor): merge enforcement-scope clarification into OTP rewrite (#9607)
Layers main's #9607 clarification onto next's #9057 OTP-enablement rewrite.
The "Sign In with 2FA" section now states that 2FA sign-in enforcement
applies to the credential endpoints (/sign-in/email, /sign-in/username,
/sign-in/phone-number) and that passwordless flows are not gated by default,
with guidance to add custom hook handling to require it. The passwordless
callout and the allowPasswordless option note that the flag does not change
which sign-in methods are challenged. main's edit to the removed
skipVerificationOnEnable bullet is dropped, since next deleted that option.

(cherry picked from commit 6156cef51329e1c38544aa06eb5072d8a06ece7a)
2026-05-31 00:10:36 +01:00
..