TL;DR:<\/strong><\/p>\n Start with an app fit review<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n Delegating authentication means your application hands the login process to a specialist identity provider (IdP) rather than handling passwords and codes itself. The app receives a signed token confirming who the user is, and never touches the credential directly. Standard protocols such as OIDC and SAML reduce risk precisely because they\u2019ve been tested against years of real attacks. A QoA parameter<\/a> can even request a minimum assurance level, so the IdP presents a stronger method automatically when the transaction warrants it.<\/p>\n In-app 2FA still has a place. If you\u2019re building a small internal tool with a handful of staff and no regulatory exposure, coding a TOTP check yourself might be faster and cheaper than integrating an external IdP. The drawback is that you now own every security update, every edge case, and every future vulnerability that surfaces in your custom code.<\/p>\n Decide based on:<\/p>\n Practitioner guidance is consistent on this point: projects that build proprietary 2FA rather than relying on standard protocols tend to carry higher long-term maintenance and security risk than teams expect at the outset.<\/p>\n Not every login needs the same level of friction. Matching the method to the risk of the transaction keeps staff and customers moving without weakening protection where it matters.<\/p>\n Cost and distribution matter too. SMS carries a per-message fee at scale; hardware keys need procurement and replacement logistics; push and TOTP are effectively free once integrated. For a customer-facing app with thousands of users, that arithmetic often decides the method before security even enters the conversation.<\/p>\n A developer can only build what you specify. Vague briefs like \u201cadd two-factor authentication\u201d produce vague, expensive rework later. Hand over the following before any code is written.<\/p>\n Protocol and flow requirements:<\/strong><\/p>\n Endpoints and token handling:<\/strong><\/p>\n Redirect and session security:<\/strong><\/p>\n Acceptance tests to demand before sign-off:<\/strong><\/p>\n Pro Tip:<\/strong> Ask your developer to demonstrate a failed login attempt with an expired or tampered token, not just a successful one. Most integration bugs hide in the failure paths, not the happy path.<\/em><\/p>\n If your organisation needs to connect to a legacy SAML identity provider or a government-issued identity service, an identity broker (the Keycloak pattern is a common example) can convert SAML responses into JWTs your app already understands, avoiding a second, parallel authentication system.<\/p>\n Two-factor authentication is not a standalone fix. Government guidance on secure remote access is explicit that 2FA works best alongside strong password hygiene, regular patching, and active monitoring, not as a replacement for any of them.<\/p>\n Build these controls in alongside your second factor:<\/p>\n The real gap most SMEs miss:<\/strong> phishing resistance isn\u2019t just about which method you choose. It\u2019s about whether your recovery process can be socially engineered around the second factor entirely. A support desk that resets 2FA on a phone call is a bigger risk than weak passwords.<\/p>\n<\/blockquote>\n Recovery deserves particular care. Multi-step human verification before reissuing access, strict limits on backup-code issuance, and centralised logging of recovery attempts close off the most common route attackers use to bypass a second factor without ever cracking it.<\/p>\n Budget for four categories: initial development, any IdP subscription fees, per-message SMS costs if you use them, and hardware key procurement for privileged staff. Development is usually the largest one-off cost; SMS and hardware keys are the ongoing, usage-linked ones.<\/p>\n Maintenance doesn\u2019t stop at launch. SMEs routinely underbudget lifecycle tasks such as certificate rotation, library updates, and dependency patching, and skipping these creates the exact vulnerabilities 2FA was meant to close. Build them into your service-level agreement upfront, not as an afterthought.<\/p>\n Ownership matters too. Policy changes (who needs step-up, which roles need FIDO) typically live with whoever manages the central IdP configuration. Application-level changes (how the app requests and handles tokens) sit with your development team. Ask for:<\/p>\n Every 2FA project starts with a question, not a solution: what is the actual operational risk you\u2019re trying to close? A complimentary app fit review works through that before any development conversation happens, weighing whether adapting an existing product foundation gets you there faster than a custom build or whether your workflow genuinely needs something bespoke.<\/p>\n The pitfalls repeat across SME projects. Maintenance budgets get set for the launch date and nothing after. Recovery flows get built as an afterthought, then become the weakest link in the whole system. And SMS gets used for admin accounts because it was the fastest thing to wire up, not because anyone weighed the risk.<\/p>\n None of this is exotic. It\u2019s what happens when authentication gets treated as a checkbox instead of a design decision made against your actual risk profile.<\/p>\n \u2014 Ronald<\/em><\/p>\n<\/blockquote>\n This company offers a practical route for SMEs who\u2019d rather confirm the right approach before spending on development than discover it was wrong halfway through a build. A complimentary app fit review<\/a> looks at your actual workflow and tells you plainly whether a delegated IdP integration, an adapted existing product, or a genuinely custom build fits your situation, along with a realistic cost range and timeline before anything is committed.<\/p>\n That review exists specifically to stop SMEs overspending on complexity they don\u2019t need, or underbuilding something that creates risk later. If you\u2019re weighing up costs before you commit to a scope, the app development cost guide<\/a> gives a useful sense of what different approaches typically involve. When you\u2019re ready to talk specifics, book a review and get a clear answer on the right path for your app.<\/p>\n Technical guidance cited throughout this piece comes from documented OIDC integration patterns and national identity service architectures<\/a>. For broader website security context, see this SMB security checklist, and for ongoing authentication auditing, Aisyndicate<\/a>.<\/p>\n OIDC is generally simpler to integrate with modern web and mobile apps, while SAML remains common with legacy enterprise and government identity services; an identity broker can bridge the two if you need both.<\/p>\n Delegated IdP hands authentication to an external, standards-based provider, while in-app 2FA means your own codebase generates and checks the second factor, carrying more long-term maintenance risk.<\/p>\n SMS OTP is acceptable for lower-risk customer journeys but should never be the only option for admin or privileged accounts, where phishing-resistant methods like FIDO or push are the stronger choice.<\/p>\n Costs vary by integration complexity, chosen methods, and whether you\u2019re adapting an existing product or building custom; Flowlab\u2019s complimentary app fit review gives a scoped estimate before you commit to development.<\/p>\n At minimum, tests should cover successful and failed authorization code exchange, token signature verification, a working step-up prompt, and a simulated recovery flow check.<\/p>\n Commission two factor authentication apps with exact specs, security and upkeep checklists for SMEs, and book a free app fit review.<\/p>\n","protected":false},"author":1,"featured_media":137,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-136","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.flowlab.works\/blog\/wp-json\/wp\/v2\/posts\/136","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.flowlab.works\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.flowlab.works\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.flowlab.works\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.flowlab.works\/blog\/wp-json\/wp\/v2\/comments?post=136"}],"version-history":[{"count":1,"href":"https:\/\/www.flowlab.works\/blog\/wp-json\/wp\/v2\/posts\/136\/revisions"}],"predecessor-version":[{"id":139,"href":"https:\/\/www.flowlab.works\/blog\/wp-json\/wp\/v2\/posts\/136\/revisions\/139"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.flowlab.works\/blog\/wp-json\/wp\/v2\/media\/137"}],"wp:attachment":[{"href":"https:\/\/www.flowlab.works\/blog\/wp-json\/wp\/v2\/media?parent=136"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.flowlab.works\/blog\/wp-json\/wp\/v2\/categories?post=136"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.flowlab.works\/blog\/wp-json\/wp\/v2\/tags?post=136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n
\nTable of Contents<\/h2>\n
\n
When to delegate authentication to an IdP and when to build 2FA into your app<\/h2>\n
\n
Which second-factor methods actually fit your use case<\/h2>\n
\n
What to give your developer: the integration checklist<\/h2>\n
\n
\n
\n
\n
![\"Identity](\"https:\/\/www.flowlab.works\/blog\/wp-content\/uploads\/2026\/09\/1789146397855_Identity-broker-converting-SAML-into-JWT.jpeg\")
<\/p>\nSecurity checklist: the controls that make 2FA actually work<\/h2>\n
\n
\n
Costs, maintenance and who owns what afterwards<\/h2>\n
\n
How Flowlab scopes and delivers 2FA work for SMEs<\/h2>\n
\n
Get a complimentary app fit review before you brief a developer<\/h2>\n
![\"Flowlab\"](\"https:\/\/www.flowlab.works\/blog\/wp-content\/uploads\/2026\/08\/1787190647142_flowlab.jpg\")
<\/p>\nSources<\/h2>\n
\n
FAQ<\/h2>\n
Should I use OIDC or SAML for my application?<\/h3>\n
What\u2019s the difference between delegated IdP and in-app two factor authentication apps?<\/h3>\n
Is SMS OTP secure enough for customer accounts?<\/h3>\n
How much does adding 2FA to an existing app typically cost?<\/h3>\n
What should a developer\u2019s acceptance tests for 2FA include?<\/h3>\n
Recommended<\/h2>\n
\n