From f013f7ae1565bdf7c341b6998f7a7a8ba871552d Mon Sep 17 00:00:00 2001
From: Dan Harrin <git@danharrin.com>
Date: Wed, 9 Sep 2026 10:42:41 +0100
Subject: [PATCH] docs: Document app authentication cache requirements (#20474)

* docs: Document app authentication cache requirements

Co-authored-by: Amp <amp@ampcode.com>

* docs: Use warning for app authentication cache requirements

Co-authored-by: Amp <amp@ampcode.com>

---------

Co-authored-by: Amp <amp@ampcode.com>
---
 docs/07-users/02-multi-factor-authentication.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docs/07-users/02-multi-factor-authentication.md b/docs/07-users/02-multi-factor-authentication.md
index cfd8ab7a17..3ebc95ca78 100644
--- a/docs/07-users/02-multi-factor-authentication.md
+++ b/docs/07-users/02-multi-factor-authentication.md
@@ -82,6 +82,10 @@ public function panel(Panel $panel): Panel
 }
 ```
 
+<Aside variant="warning">
+    To prevent the same app authentication code from being accepted more than once, use a default cache store that supports atomic locks, such as the database or Redis cache driver. All application servers must use the same cache backend. With other cache configurations, concurrent requests may accept the same code more than once.
+</Aside>
+
 ### Setting up app recovery codes
 
 If your users lose access to their two-factor authentication app, they will be unable to sign in to your application. To prevent this, you can generate a set of recovery codes that users can use to sign in if they lose access to their two-factor authentication app.