I was also wondering about (simple) two-factor authentication via e-mail (not OTP).

It feels like a simple addition since the logic to generate a token and verify a user is already there. It would just need to be used to log the user in—after entering the credentials—instead of setting the is_verified column to True. So:

1. User enters credentials
2. Token is generated and passed to the user (e. g. via e-mail or SMS)
3. User clicks a link and submits the token
4. User is being logged in

What if you are trying to authenticate in a mobile app or some dedicated desktop app, rather than in a browser?
Your email client will open default browser when you click a link, so any other type of app won't get a chance to access it.

2FA codes solve this problem, since they are easy enough for users to enter manually, but as I understand that won't work with fastapi-users.

Well it is somewhat possible (https://en.wikipedia.org/wiki/Mobile_deep_linking) but yes, in this case a one time password would come in handy.

Still, for a browser-based app the existing token could be used.

Still no plans to somehow support 2FA? I wonder if other users have a working 2FA flow already; e.g. if it can be done be implementing it in my fastapi project.

I have added a comment in another thread with a suggestion on how to implement this: #1389 (comment)