We are looking for a service/API/library to help us implement a push-based two-factor authentication (2FA) system to supplement the existing SMS-based 2FA on our website.
We need a system that provides an API for us to enroll users and send/receive authentication success/failure messages. (We build all our login/authentication features with custom server code and are comfortable working directly with REST APIs.) We also need the system to provide an Android/iOS app that users can easily install and pair with their website account (perhaps via one-time numeric or QR code).
Why not just use Google Authenticator? We want the following user experience: When they enter the correct username and password to log into their account on our website, we would trigger a push notification to their device via the app, and then they would tap Approve/Deny, which response would be sent back to our server (or obtained by polling) to complete the authentication process. To my knowledge, Google doesn't yet offer this push-to-accept UX, rather users must manually enter into our website the code that was presented via the app.
What volume are we looking at? We currently have many thousands of user accounts, but only around 300 are using SMS-based 2FA, and they are logging in around once per month. We anticipate that some of those would switch to push-based 2FA, but slowly and over time. Perhaps about 500 concurrent push-based 2FA users would be our goal over the next few years.
The smartphone app does not need to be white-labeled, but the enrolment process should stay on our website (no third-party portal redirect, no or minimal user information stored on the third party service, everything done through API and instructions to user.)
So far, Authy is the cheapest and most straightforward solution I've found, but it would cost $0.09/auth. At our volume, that's not too expensive, but I'm wondering if there are cheaper/better solutions out there for our use case.
I'm also wondering how hard it would be to roll our own solution with something like Firebase Cloud Messaging. The key is that we don't want to spend a lot of resources on developing our own app. Ideally all the app would do is subscribe to these 2FA push notifications and relay the Approve/Deny responses back to our servers. Maybe there are some simple app templates that could be easily customized/branded for our company? (If it was a well-known app like Google Authenticator or Authy, we wouldn't need branding, but if we roll our own, I guess we would.)
