Getting there with Devise MFA

app/controllers/application_controller.rb

@@ -1,3 +1,10 @@
 class ApplicationController < ActionController::Base
     before_action :authenticate_user!
+    before_action :configure_permitted_parameters, if: :devise_controller?
+
+    protected
+
+    def configure_permitted_parameters
+        devise_parameter_sanitizer.permit(:sign_in, keys: [:otp_attempt])
+    end
 end

app/models/user.rb

@@ -1,5 +1,6 @@
 class User < ApplicationRecord
+  devise :two_factor_authenticatable
   # Include default devise modules. Others available are:
   # :confirmable, :lockable, :timeoutable, :trackable and :omniauthable
-  devise :database_authenticatable, :recoverable, :rememberable, :validatable, :lockable, :timeoutable, :trackable, :registerable
+  devise :recoverable, :rememberable, :validatable, :lockable, :timeoutable, :trackable, :registerable
 end