### Enrol, confirm, and challenge with TwoFactor facade

Source: https://github.com/roundly-consulting/two-factor-for-laravel/blob/main/README.md

Use the TwoFactor facade to start setup, confirm with the first authenticator code, attempt a TOTP or recovery code, and check status. The provisioningUri is an otpauth:// URI to render as a QR code; recoveryCodes are shown once. attempt() is replay-safe and accepts a single-use recovery code.

```php
use RoundlyConsulting\TwoFactor\Facades\TwoFactor;

$setup = TwoFactor::for($user)->start(issuer: 'Acme');
$setup->provisioningUri;                          // otpauth://totp/Acme:… — render it as a QR code
$setup->recoveryCodes;                            // list<string> — show these once

TwoFactor::for($user)->confirm($code);            // the first authenticator code switches 2FA on

$result = TwoFactor::for($user)->attempt($code);  // TOTP (replay-safe) or a single-use recovery code
$result->verified;                                // bool
$result->method;                                  // TwoFactorMethod::Totp | ::RecoveryCode | null

TwoFactor::for($user)->status()->enabled;         // true
```

--------------------------------

### Install two-factor-for-laravel with Composer and publish migrations

Source: https://github.com/roundly-consulting/two-factor-for-laravel/blob/main/README.md

Run these commands to install the package, publish its migrations, and run them. Requires PHP 8.4 and Laravel 12 or 13. The migration adds four nullable columns to the users table; set TWO_FACTOR_TABLE before migrating if your accounts are in another table.

```bash
composer require roundly-consulting/two-factor-for-laravel
php artisan vendor:publish --tag="two-factor-migrations"
php artisan migrate
```

--------------------------------

### Prepare User model with HasTwoFactorAuthentication trait

Source: https://github.com/roundly-consulting/two-factor-for-laravel/blob/main/README.md

Add the HasTwoFactorAuthentication trait and implement TwoFactorAuthenticatable on your User model. Include twoFactorCasts() in the casts() method to enable the package's encrypted secret and recovery code casting.

```php
use Illuminate\Foundation\Auth\User as Authenticatable;
use RoundlyConsulting\TwoFactor\Concerns\HasTwoFactorAuthentication;
use RoundlyConsulting\TwoFactor\Contracts\TwoFactorAuthenticatable;

final class User extends Authenticatable implements TwoFactorAuthenticatable
{
    use HasTwoFactorAuthentication;

    protected function casts(): array
    {
        return [...$this->twoFactorCasts()];
    }
}
```