How to get MFA API Access Tokens?

[benjamin_mumma]

Hello,

We are attempting to create a page on our site that will allow the user to to enroll in MFA with a phone number they provide.

We are attempting to leverage the MFA API to acomplish this task, however we are struggling to gain an MFA API Token.

The documentation, found here, is vague in attempting to retrieve a token WITHOUT the login flow.

The documentation indicates, “If you are building a user interface to manage authentication factors, you’ll need to obtain a token you can use for the MFA API at any moment, not only during authentication.”

How do we go about obtaining this token? Is there an endpoint I’m missing to retrieve an MFA token?

[tyf]

Hi there @benjamin_mumma!

@benjamin_mumma

We are attempting to leverage the MFA API to acomplish this task, however we are struggling to gain an MFA API Token.

The documentation, found here, is vague in attempting to retrieve a token WITHOUT the login flow.

This is admittedly a bit of a tricky topic - I believe the following posts may prove helpful:

Associate MFA factor from own UI: error on factor activation

Hey @thijmen96 It’s admittedly confusing, but the “MFA token” can be obtained in two ways: what’s returned as the mfa token along with the mfa_required error in the resource owner password grant flow the access token you obtain with regular /authorize request, with an audience=https://YOUR_AUTH0_DOMAIN/mfa/ and scopes enroll read:authenticators delete:authenticators So, essentially, the same token used for enrollment is used to confirm the authenticator. If you are using custom domains the…

Custom UI to challenge MFA post login

Response from Auth0 support ticket: The approach shown on https://auth0.com/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/enroll-and-challenge-otp-authenticator, as you’ve already correctly understood, is for building your own UI. It will still use our Authentication pipeline as usual. " How would I generate this MFA_TOKEN post login? I don’t want the user to re-enter their credentials again or re-confirm via SSO. " MFA only works as an extensibility endpoint d…

Basically, obtaining an MFA API token cannot be fully decoupled from the login flow.

Hope this helps to clarify!

[benjamin_mumma]

Thanks tyf. I’ll take a look at the links you sent over