Model setup

use Illuminate\Foundation\Auth\User as Authenticatable;
use RoundlyConsulting\TwoFactor\Concerns\HasTwoFactorAuthentication;
use RoundlyConsulting\TwoFactor\Contracts\TwoFactorAuthenticatable;

final class User extends Authenticatable implements TwoFactorAuthenticatable
{
    use HasTwoFactorAuthentication;

    protected function casts(): array
    {
        return [
            // ...your other casts
            ...$this->twoFactorCasts(),
        ];
    }
}

return $user;          // from a route — no secret, no recovery codes
$user->toArray();      // two_factor_secret, two_factor_recovery_codes and
$user->toJson();       // two_factor_last_used_timestep are always hidden

$user->two_factor_confirmed_at; // stays visible for UI state

$user->hasTwoFactorEnabled();               // secret set + confirmed
$user->hasPendingTwoFactor();               // secret set, not yet confirmed
$user->twoFactorSecret();                   // ?string
$user->twoFactorRecoveryCodes();            // list<string>
$user->twoFactorRecoveryCodesRemaining();   // int
$user->twoFactorLabel();                    // provisioning label (email → primary key)

final class User extends Authenticatable implements TwoFactorAuthenticatable
{
    use HasTwoFactorAuthentication;

    // Key the otpauth:// label on a username instead of the email.
    public function twoFactorLabel(): string
    {
        return $this->username;
    }
}