Describe the feature you'd like to request

Most apps allows user to setup a second authentication layer in the case a hacker figures out their password.

Describe the solution you'd like

Please add 2-factor authentication in the auth toolkit. Each user should be able to configure this when logged in. If enabled, sign-in form should ask for the 2-factor. The 2FA should use something like Google Authenticator.

Describe alternatives you've considered

I've considered authenticator apps, SMS verification, email verification, and security keys. There's a cost to SMS. It's possible to lose security keys. If your email is also hacked then can be problematic and if you lose your phone then authenticator apps might be problematic.

So maybe a combination of authenticator app, email and security keys?