# Two-factor Challenge

> The second step after a password, with four methods. An authenticator code submits itself on the last digit, a text is sent on request with a resend countdown, a security key waits for a touch and lets you retry, and a backup code formats as XXXX-XXXX. Try another way lists the other methods, the card eases between them, and a trust-this-device checkbox rides along.

- Slug: `two-factor-challenge`
- Category: [Authentication](https://www.assembli.design/category/authentication.md)
- Type: component
- Tags: 2fa, mfa, two-factor, otp, verification, security-key, webauthn, backup-code, auth
- npm dependencies: motion, lucide-react
- shadcn/ui dependencies: @assembli/otp-input, @assembli/text-field
- Added: 2026-10-24
- Live preview: https://www.assembli.design/preview/two-factor-challenge
- Page: https://www.assembli.design/components/two-factor-challenge

## Install

One-time setup (needs a subscription):

1. Add the registry to the project's `components.json`: `{"@assembli":{"url":"https://www.assembli.design/r/{name}.json","headers":{"Authorization":"Bearer ${ASSEMBLI_API_KEY}"}}}` (merge into `"registries"`).
2. Put an API key from https://www.assembli.design/account in `.env.local` as `ASSEMBLI_API_KEY=asm_…`.

Then install with the shadcn CLI (writes `components/two-factor-challenge/two-factor-challenge.tsx` and installs dependencies):

```bash
npx shadcn@latest add @assembli/two-factor-challenge
```

Registry item JSON: https://www.assembli.design/r/two-factor-challenge.json (send `Authorization: Bearer <api key>`)

## Code

> Component source needs an Assembli subscription ($12/month) and an API key sent as `Authorization: Bearer <key>`. To get one without copying anything, POST https://www.assembli.design/api/agent/login (or call the MCP tool connect_account), show the user the link it returns, and poll https://www.assembli.design/api/agent/token for the key. Or subscribe at https://www.assembli.design/pricing and create a key at https://www.assembli.design/account.