TOTP

Stands for time-based-on-time password.

ff you use open standards like TOTP (RFC 6238), you can generate and verify 2FA codes entirely on your own servers or client-side (e.g., using libraries like speakeasy or pyotp).

• Example: Google Authenticator or Authy apps generate TOTP codes based on a shared secret between the app and your server. No third-party API is needed.
• Pros: No dependency on external services; fully self-hosted.
• Cons: You’re responsible for securing the shared secrets and handling backup/recovery.