Ok, so WP-Piwik has to add an additional auth_code parameter to each API call. But there is no general auth_code, it is delivered by the 2FA, of course. Thus, WP-Piwik has to integrate its own authentication, hasn’t it? I added this to my longlist, but currently there are no concrete plans to implement this.
Or did I get this wrong?
If you like to use WP-Piwik while 2FA is activated, you should use the PHP API instead of the HTTP API. This requires WordPress and Piwik running at the same server, but this also avoids the “public” transfer between Piwik and WordPress (including the stats, but also the current auth_code and your token_auth).