MFA Multi-Factor Authentication in Morocco: DSI Guide 2026

// api/auth/setup-mfa.ts
import { authenticator } from 'otplib';
import QRCode from 'qrcode';

export async function POST(req: Request) {
  const { userId } = await req.json();
  
  // Generate unique secret
  const secret = authenticator.generateSecret();
  
  // Save secret in DB (encrypted!)
  await saveUserMFASecret(userId, secret);
  
  // Generate QR code
  const otpauth = authenticator.keyuri(
    userId, 
    'YourApp', 
    secret
  );
  const qrCode = await QRCode.toDataURL(otpauth);
  
  return Response.json({ qrCode, secret });
}

// api/auth/verify-mfa.ts
import { authenticator } from 'otplib';

export async function POST(req: Request) {
  const { userId, token } = await req.json();
  
  // Retrieve secret from DB
  const secret = await getUserMFASecret(userId);
  
  // Verify token
  const isValid = authenticator.verify({ 
    token, 
    secret 
  });
  
  if (isValid) {
    // Create authenticated session
    return Response.json({ success: true });
  } else {
    return Response.json({ 
      success: false, 
      error: 'Invalid code' 
    }, { status: 401 });
  }
}