<?php $form = ActiveForm::begin([
        'id' => 'ajax-twofactor-verify',
        'validationUrl' => ['verify_google_code'],
        'enableAjaxValidation' => true,
    ]); ?>

    <?= $form->field($twoFactorModel, 'googleCode', [
        'inputOptions' => [
            'class' => 'form-control',
            'placeholder' => Yii::t('app', 'Google Authenticator Code'),
        ],
    ])->label(false) ?>

    <div class="form-group">
        <?= Html::submitButton('Verify', ['class' => 'btn btn-primary', 'id' => 'twofactor-submit']) ?>
    </div>

<?php ActiveForm::end() ?>

public function actionVerify_google_code()
{
    $twoFactorModel = new GoogleFactorForm(User::findOne(Yii::$app->user->getId()));
    if (Yii::$app->request->isAjax && $twoFactorModel->load(Yii::$app->request->post())) {
        Yii::$app->response->format = Response::FORMAT_JSON;
        return ActiveForm::validate($twoFactorModel);
    }
    return $this->redirect(['index']);
}

public function actionIndex($tab = null)
{
    // check if user enabling or disabling two factor authentication
    if (Yii::$app->request->isPost && Yii::$app->request->post('GoogleFactorForm') !== null) {
        $twoFactorModel = new GoogleFactorForm(User::findOne(Yii::$app->user->getId()));
        $twoFactorModel->load(Yii::$app->request->post());
        if ($twoFactorModel->save()) {
            echo 'success';
        }
        echo 'fail';
        exit;
    }

public function rules()
{
    return [
        [['googleCode'], 'required'],
        [['googleCode'], 'string'],
        ['googleCode', 'validateGoogleCode'],
    ];
}

public function validateGoogleCode($attribute)
{
    if (!$this->hasErrors()) {
        $g = new GoogleAuthenticator();
        $google_code = Setting::get(sprintf(Setting::USER_TWOFACTORAUTH_GOOGLE_CODE, $this->user->getId()));
        if (!$g->checkCode($google_code, $this->googleCode)) {
            $this->addError($attribute, Yii::t('app', 'Invalid google secret'));
        }
    }
}