How can user change phone number used for MFA

[tyf]

Hey there @ssp6 welcome to the community!

@ssp6

Create our own API’s that will add a new MFA authenticator, remove the old one then return the MFA token for the user to use to type in the code sent to them

I think you’re on the right track with this - You want to make sure there is no gap between old and new factor so adding the new one and then deleting the old one in that order is important.

General Idea:

1. The user accesses the “profile” page and chooses “Change phone number”.
2. The page checks redirects the user to Auth0 to authenticate and use MFA API as audience. Make sure MFA is enforced to prevent account takeover.
3. Once the re-auth is completed - Use the MFA token to register the new phone number as a factor and delete the old one (in this order - so that the account doesn’t stay without MFA at all even for a short time).

https://auth0.com/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/manage-authenticator-factors-mfa-api

Hope this helps!