# Auth0 mfa-otp grant flow sequence diagram or something like that?

**URL:** <https://community.auth0.com/t/auth0-mfa-otp-grant-flow-sequence-diagram-or-something-like-that/73001>\
**Category:** Get Help\
**Tags:** oauth2\
**Created:** [November 11, 2021, 5:00pm UTC](https://community.auth0.com/t/auth0-mfa-otp-grant-flow-sequence-diagram-or-something-like-that/73001 "2021-11-11T17:00:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Uzlopak](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/uzlopak/32/32940_2.png) [@Uzlopak](https://community.auth0.com/u/Uzlopak)\
**Post date:** [November 11, 2021, 5:00pm UTC](https://community.auth0.com/t/auth0-mfa-otp-grant-flow-sequence-diagram-or-something-like-that/73001/1 "2021-11-11T17:00:14Z")

</div>

Hi,

I would like to know how the mfa-otp grant works. What http codes are sent back and forth. What is the potential payload and result of each http call. etc… A sequence diagram would be super helpful.

Where can I find it?

Thx

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [November 11, 2021, 10:22pm UTC](https://community.auth0.com/t/auth0-mfa-otp-grant-flow-sequence-diagram-or-something-like-that/73001/3 "2021-11-11T22:22:01Z")

</div>

Hi @Uzlopak,

Welcome to the Auth0 Community!

I understand that you are looking for more information about the mfa-opt grant flow.

First, have you taken a look at our [Resource Owner Password Flow](https://auth0.com/docs/authorization/flows/resource-owner-password-flow) diagram which is used in conjunction with [MFA Support](https://auth0.com/docs/authorization/flows/resource-owner-password-flow#mfa-support)?

Then you can learn more in our [Authenticate Using the Resource Owner Password Flow with MFA](https://auth0.com/docs/login/mfa/ropg-mfa) and [Enroll and Challenge OTP Authenticators](https://auth0.com/docs/login/mfa/ropg-mfa/enroll-and-challenge-otp-authenticators#challenge-with-otp) documentation for further details.

As for the error codes, they are consistent with the OAuth2 Specification. The success codes can be found [here](https://datatracker.ietf.org/doc/html/rfc6749#section-5.1) and the error codes [here](https://datatracker.ietf.org/doc/html/rfc6749#section-5.2)

Hoped this helps!

Please let me know if there’s anything else I can do to help.

Thanks.

---

<div class="post-metadata">

**Author:** ![Uzlopak](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/uzlopak/32/32940_2.png) [@Uzlopak](https://community.auth0.com/u/Uzlopak)\
**Post date:** [November 12, 2021, 9:50pm UTC](https://community.auth0.com/t/auth0-mfa-otp-grant-flow-sequence-diagram-or-something-like-that/73001/4 "2021-11-12T21:50:56Z")

</div>

`When MFA is enabled, the response includes an `mfa\_required`error and a`mfa\_token` .`

Do you get a 401 Error or a different Error code? 403?

What does the abbreviation of oob stands for?  
[https://auth0.com/docs/login/mfa/ropg-mfa/enroll-challenge-sms-voice-authenticators#enroll-authenticator](https://auth0.com/docs/login/mfa/ropg-mfa/enroll-challenge-sms-voice-authenticators#enroll-authenticator)

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [November 13, 2021, 12:42am UTC](https://community.auth0.com/t/auth0-mfa-otp-grant-flow-sequence-diagram-or-something-like-that/73001/5 "2021-11-13T00:42:14Z")

</div>

Hi @Uzlopak,

Thank you for your response.

> [@Uzlopak](#):
>
> What does the abbreviation of oob stands for?

The term _OOB_ stands for _out-of-band_, used to refer to 2FA that requires a secondary verification method through a separate communication channel. In this case, it refers to using SMS, email, or authenticators for MFA.

Next, could you please provide me with the complete error message and error code when requesting the `/oauth/token` endpoint?

Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [November 28, 2021, 12:43am UTC](https://community.auth0.com/t/auth0-mfa-otp-grant-flow-sequence-diagram-or-something-like-that/73001/6 "2021-11-28T00:43:13Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.