When I set out to build this authentication service, the goal was simple but critical: provide a robust, drop-in backend for Two-Factor Authentication (2FA). Passwords alone aren't enough anymore, and integrating Time-Based One-Time Passwords (TOTP) that work seamlessly with apps like Google Authenticator or Authy is a must-have for modern applications. This project served as a deep dive into the mechanics of TOTP and cryptographic secrets.

I architected the API using Node.js and Express, connected to a MongoDB database via Mongoose. For the core 2FA functionality, I used the `otpauth` library to handle the algorithm alongside `qrcode` and `hi-base32` to generate secrets and scan-able URIs. When a user requests to enable 2FA, the server generates a unique Base32 secret, builds the TOTP URL, and renders a QR code on the fly using EJS. From there, users can scan it into their app, verify the setup with an initial token, and subsequently use their app to validate login attempts.

One of the interesting engineering challenges was accounting for the fact that a user's phone clock and the server clock might not be perfectly synchronized. I handled this by implementing a validation window that allows for minor time drift without immediately rejecting valid tokens. This project demonstrates my ability to implement complex, security-focused features from scratch and structure a backend API that is both clean and extensible.