Custom MFA via Actions and ROP Flow Does Not Return an mfa_token

Knowledge Solutions
, , , ,
1

Problem statement

Within Multi-factor Auth settings in the dashboard:

  • If Always is selected, the following response is received with an mfa_token in the response:
{
"error": "mfa_required",
"error_description": "Multifactor authentication required",
"mfa_token": "Fe26.2*SERVER…"
}

Customizing MFA by adding an Action to Login Flow via methods in this document.

  • The following response has been received. There is no mfa_token in the response.
{
"error": "mfa_required",
"error_description": "Multifactor authentication required",
}

Solution

This is a known limitation, and a solution should be released in the foreseeable future.