Skip to main content

Two-Factor Authentication

Fluid WidgetQuick DepositSweepstakes (Virtual)
YesNoNo

Fluid can add a two factor authentication step to the withdrawal flow: before the withdrawal is submitted, the user must enter a 6 digit authenticator code, which your platform validates.

Fluid implements no 2FA logic

This feature is a client side UI gate only. Fluid does not generate, know, or verify authenticator codes; it merely collects the code from the user and hands it to your page through the bridge handler. The actual verification must be implemented on your backend, and your platform must not treat the widget's gate as a security control on its own: enforce 2FA on the withdrawal operation server side as well.

Enabling per player​

Whether the step appears is a per player decision made by the host: your page evaluates whether the player has 2FA enabled on your platform and sets the two-factor-auth-enabled attribute to "true" accordingly. The attribute is reactive while the wallet is closed, so it can follow changes in the player's settings.

Validating the code​

Code validation is performed by your platform through the Bridge API: register a verify2FA handler as described in the Window Bridge API documentation, which also covers the request payload, the response shape and rate limit handling.

Flow summary​

  1. The host sets two-factor-auth-enabled="true" for a player with 2FA enabled.
  2. During a withdrawal, the widget asks the user for their 6 digit authenticator code.
  3. The widget calls the host's verify2FA bridge handler with the entered code.
  4. On a valid response the withdrawal proceeds; on an invalid one the user is asked to retry.