Documentation / zerotal / auth / TWO_FACTOR_PENDING_KEY

Variable: TWO_FACTOR_PENDING_KEY

const TWO_FACTOR_PENDING_KEY: "two_factor_pending" = "two_factor_pending"

Defined in: packages/auth/src/TwoFactorMiddleware.ts:20

Session key written by Auth.login when the user has a confirmed second factor.

While it is set the session is half authenticated: the password matched, the second factor has not been presented. PersistUserMiddleware therefore leaves ctx.user unset — so every route, API endpoint, admin page and Flow action treats the request as a guest — and exposes the user only through Auth.pendingTwoFactorUser so the challenge page can render. Auth.completeTwoFactor clears it.

This is what makes 2FA a login gate rather than a per-route one: enforcement does not depend on a developer remembering to attach TwoFactorMiddleware to a route.