derhansen/mfa_yubikey

YubiKey OTP MFA provider - YubiKey OTP MFA provider for the TYPO3 backend login.

4.0.2 2026-04-25 17:01 UTC

Requires

• typo3/cms-core: ^14.3

GPL-2.0-or-later

• Torben Hansen

• yubikey
• TYPO3 CMS
• Two-factor Authentication
• MFA provider

README

What is it?

A MFA provider for TYPO3 CMS which implements YubiKey OTP authentication

Screenshot

Documentation

Configuration steps:

1. Obtain Yubico Client ID and Secret Key at https://upgrade.yubico.com/getapikey/
2. Enter you Yubico Client ID and Yubico Client Key in the extension settings
3. Switch to backend user settings and choose "Manage multi-factor authentication" in "Account security" tab
4. Setup the "YubiKey OTP MFA authentication" MFA provider by adding at least one YubiKey
5. (Optional) Ensure to set the "YubiKey OTP MFA authentication" as default MFA provider

Using a self-hosted YubiCloud instance

Instead of using the official Yubico YubiCloud validation service, you can run your own OTP validation server. This is useful for organizations that require full control over their infrastructure or cannot use external services.

To use a self-hosted validation server:

1. Set up a self-hosted OTP validation server (see Yubico's self-hosted OTP validation guide)
2. In the extension settings, set the "YubiCloud API URL" to the URL of your own validation server
3. Enter the Client ID and Secret Key configured on your self-hosted instance

Versions

Version	TYPO3	PHP	Support/Development
4.x	14.x	8.2 - 8.5	Features, Bugfixes, Security Updates
3.x	13.x	8.2 - 8.5	Features, Bugfixes, Security Updates
2.x	12.x	8.1 - 8.4	Security Updates
1.x	11.5	7.4 - 8.4	Support dropped

Reporting a Vulnerability

Please report vulnerabilities to [e-mail].

Support and updates

The extension is hosted on GitHub. Please report feedback, bugs and change requests directly at https://github.com/derhansen/mfa_yubikey