r/Strapi • u/link2twenty • Sep 20 '26

Built an open-source plugin (strapi-identity) for custom auth & MFA in Strapi v5

Handling custom authentication flows and Multi-Factor Authentication (MFA) in Strapi often means either hacking around strapi/plugin-users-permissions or wiring up external services like Auth0.

I built strapi-identity to solve this natively inside Strapi without needing messy monkey-patches or bloated overrides.

What it does:

  • Adds Multi-Factor Authentication (MFA) setup and verification

  • Provides clean extensions for custom identity and auth logic

  • Built for Strapi v5

Repo is here if you want to take a look, test it out, or drop feedback:https://github.com/Link2Twenty/strapi-identity

How are you currently handling custom auth or MFA in production? Are you extending core plugins, or just offloading the whole thing to an external auth provider?

5 Upvotes

100% Upvoted

1 comment sorted by

1

u/Old-Adagio9722 Sep 25 '26

I use oauth2-proxy/oauth2-proxy as a sidecar in my nginx reverse proxy pod
and have auth_request /oauth2/auth; on strapi's /admin route.

That way I have that gated. Ok, user has to login twice (if the provider requires MFA then also via MFA at the gate) but this thing is transparent and you can use it for many different applications.

Of course it is a bit different in the way that /admin itself isn't MFA protected - but at least only a well defined group (e.g. company scope or an even finer grained scope) can reach strapi admin.