--- title: MFA for your production infrastructure running on ngrok description: ngrok's Security and Identity team describes how they built multi-factor authentication (MFA) support for account dashboards, driven by growing use of ngrok... canonical: https://daily.dev/posts/mfa-for-your-production-infrastructure-running-on-ngrok-lx44rmv8r twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: MFA for your production infrastructure running on ngrok | daily.dev og:description: ngrok's Security and Identity team describes how they built multi-factor authentication (MFA) support for account dashboards, driven by growing use of ngrok... og:url: https://daily.dev/posts/mfa-for-your-production-infrastructure-running-on-ngrok-lx44rmv8r og:image: https://api.daily.dev/og/posts/Lx44rmv8R.png og:image:alt: MFA for your production infrastructure running on ngrok og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # MFA for your production infrastructure running on ngrok **[ngrok Blog](https://daily.dev/sources/ngrok)** · 6 min read · 0 upvotes · 0 comments ## Summary ngrok's Security and Identity team describes how they built multi-factor authentication (MFA) support for account dashboards, driven by growing use of ngrok for production ingress rather than just dev/test. The writeup covers TOTP basics, a service-oriented implementation using the pquerna/otp Golang library and encrypted Postgres storage, handling MFA across ngrok's multi-tenant account model, and the security/UX tradeoffs behind choosing support-based account recovery over SMS fallback due to SIM hijacking risks. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is SMS-based MFA recovery considered less secure than authenticator app codes? SMS-based MFA is vulnerable to SIM hijacking, where attackers social-engineer a phone provider into issuing a new SIM card for a victim's number, letting them intercept text messages and bypass MFA. Authenticator app secrets, by contrast, are generally infeasible to steal remotely, making TOTP apps a stronger MFA option than SMS fallback for account recovery. _Teams weighing MFA recovery flows can compare security tradeoffs like this one on daily.dev._ ### What Go library can I use to implement TOTP-based two-factor authentication? The pquerna/otp Golang library handles TOTP code generation and verification without requiring a custom implementation of the algorithm. It was described as concise and reliable, with secrets stored securely using an internal library for encrypting data in Postgres, avoiding the risks of writing bespoke TOTP logic. _Developers evaluating auth libraries can find similar implementation write-ups on daily.dev._ ## Similar posts on daily.dev - [When attackers already have the keys, MFA is just another door to open](https://daily.dev/posts/when-attackers-already-have-the-keys-mfa-is-just-another-door-to-open-w43ekq8fj) · BleepingComputer · 0 upvotes · 0 comments - [How to Implement Two-Factor Authentication in ASP.NET Core](https://daily.dev/posts/how-to-implement-two-factor-authentication-in-asp-net-core-eyblhgeui) · Milan Jovanović · 13 upvotes · 0 comments - [Security by Design: Why Multi-Factor Authentication Matters More Than Ever](https://daily.dev/posts/security-by-design-why-multi-factor-authentication-matters-more-than-ever-rhsdyq7uu) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#devtools](https://daily.dev/tags/devtools), [#golang](https://daily.dev/tags/golang), [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/mfa-for-your-production-infrastructure-running-on-ngrok-lx44rmv8r) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"MFA for your production infrastructure running on ngrok","url":"https://daily.dev/posts/mfa-for-your-production-infrastructure-running-on-ngrok-lx44rmv8r","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/mfa-for-your-production-infrastructure-running-on-ngrok-lx44rmv8r"},"datePublished":"2026-08-23T07:20:52.435Z","dateModified":"2026-08-23T07:24:41.137Z","description":"ngrok's Security and Identity team describes how they built multi-factor authentication (MFA) support for account dashboards, driven by growing use of ngrok...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bea711e629c0886aaa4fc34e513c0248?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bea711e629c0886aaa4fc34e513c0248?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/mfa-for-your-production-infrastructure-running-on-ngrok-lx44rmv8r","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"devtools,golang,authentication","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"MFA for your production infrastructure running on ngrok"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/mfa-for-your-production-infrastructure-running-on-ngrok-lx44rmv8r#faq","mainEntity":[{"@type":"Question","name":"Why is SMS-based MFA recovery considered less secure than authenticator app codes?","acceptedAnswer":{"@type":"Answer","text":"SMS-based MFA is vulnerable to SIM hijacking, where attackers social-engineer a phone provider into issuing a new SIM card for a victim's number, letting them intercept text messages and bypass MFA. Authenticator app secrets, by contrast, are generally infeasible to steal remotely, making TOTP apps a stronger MFA option than SMS fallback for account recovery. Teams weighing MFA recovery flows can compare security tradeoffs like this one on daily.dev."}},{"@type":"Question","name":"What Go library can I use to implement TOTP-based two-factor authentication?","acceptedAnswer":{"@type":"Answer","text":"The pquerna/otp Golang library handles TOTP code generation and verification without requiring a custom implementation of the algorithm. It was described as concise and reliable, with secrets stored securely using an internal library for encrypting data in Postgres, avoiding the risks of writing bespoke TOTP logic. Developers evaluating auth libraries can find similar implementation write-ups on daily.dev."}}]} ```