The Authy API has reached End of Support: how to migrate push and TOTP 2FA
U2 Secured Security Team · · 6 min read
If your product still sends two-factor through the Authy API, you are on borrowed time. Twilio says the API has reached End of Support, is closed to new customers, and “will be fully deprecated in the future”. Here is what that means, what Twilio offers instead, and how to move push and TOTP two-factor to a platform that ships both.
Where the Authy API stands
From Twilio’s own comparison page:
- “Authy API has reached End of Support.”
- “The Authy API is now closed to new customers and will be fully deprecated in the future.”
- “Existing customers will not be impacted at this time until Authy API has reached End of Life.”
- “The Twilio Authy mobile apps will not be supported by Verify Push.”
Twilio — Authy vs Verify. There is no published End of Life date — which is exactly the problem. A migration you plan is cheaper than one you are forced into.
Your options
Twilio’s recommended path is Verify v2. For push, Verify Push works through an SDK you build into your own mobile app — so if your users currently approve sign-ins in the Authy app, moving to Verify Push means shipping and maintaining an authenticator experience yourself. For many teams that is a larger project than the migration.
U2 Secured Authenticator takes the other route: your users install a ready-made authenticator app (free on the App Store and Google Play) and your backend talks to one API.
| Push in your own app | U2 Secured Authenticator | |
|---|---|---|
| Mobile app to build and maintain | Yes — yours | No — ours, free for users |
| Branding on the approval prompt | Full control | Your logo and app name |
| Number matching | You implement it | Built in, always on |
| Biometric to approve | You implement it | Built in |
| TOTP | A separate integration | Same SDK; validated locally, never metered |
| Result delivery | Varies | Signed webhook + delivery log |
How to migrate
- Create an app and key in the developer portal. The free Developer tier covers 1,000 monthly active users and 100 push approvals a month to evaluate with — install the SDK.
- Run both side by side. Keep the Authy path for existing users while new and returning users enrol in U2. Your sign-in code chooses per user.
- Plan for re-enrolment. Assume each user enrols afresh: scan a new QR for TOTP, or enter a pairing code in the app for push — TOTP enrolment, push enrolment. Prompt at sign-in rather than by email; it converts better and is harder to phish.
- Swap the verification calls. TOTP is checked locally in your own backend; push is one request and a signed webhook.
- Retire the Authy path once the remaining users have moved, before Twilio sets the date for you.
import { U2Auth, generateSecret, generateQRCodeURI, validateTOTP } from "@u2secured/u2auth";
const client = new U2Auth(process.env.U2_API_KEY);
// TOTP: enrol, then verify locally — no per-check API call
const secret = generateSecret();
const uri = generateQRCodeURI("Acme", "ada@example.com", secret);
const ok = validateTOTP(secret, userCode);
// Push: tap-to-approve with number matching
const { approval_id } = await client.requestPush(userId, "Login from Chrome on macOS");
// → signed webhook fires { approval_id, status: "approved" }The same calls exist in Go and Python. Pricing is by monthly active users and push approvals — TOTP checks are never metered on any plan.
What this does not stop