title: Token-specific claims for 2FA
body: <p>I am looking to implement my own custom 2FA (<a href="https://en.wikipedia.org/wiki/Time-based_One-time_Password_algorithm" rel="nofollow noreferrer">TOTP</a>-based, e.g. usable by Google Authenticator and similar apps) for Firebase Authentication (using email/password authentication). Verifying the code is simple. Implement TOTP or use a library in a cloud function and test that against a code sent from the client. However, remembering that a session is valid (has been 2FA-authed) is a different story. I could try custom claims, but those apply to all new sessions, not just the current one.</p>
  
  <p>What I would like to do is somehow issue a new ID token from a cloud function with a custom claim (e.g. <code>trusted: true</code>) that <em>only exists on that token</em> and no future ones.</p>