# Malformed mfa\_token message when trying to challenge an user with MFA **URL:** \ **Category:** Get Help\ **Tags:** api, mfa, auth0\ **Created:** [June 8, 2021, 2:57pm UTC](https://community.auth0.com/t/malformed-mfa-token-message-when-trying-to-challenge-an-user-with-mfa/64112 "2021-06-08T14:57:47Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![dharasis.behera](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dharasis.behera/32/13346_2.png) [@dharasis.behera](https://community.auth0.com/u/dharasis.behera)\ **Post date:** [June 8, 2021, 2:57pm UTC](https://community.auth0.com/t/malformed-mfa-token-message-when-trying-to-challenge-an-user-with-mfa/64112/1 "2021-06-08T14:57:48Z")
I am developing an iPhone application to demonstrate the MFA using sms factor with MFA APIs for POC. I am using the authorisation flow for getting my access token (where I get a authorisation code and redeem it for an access token)earlier to MFA implementation. From the documentation, I found out that I need an MFA\_token to work with MFA APIs. I added few changes with my existing authorisation process. I am getting an MFA Token by doing the following steps: 1. Added scope **enroll** **read:authenticators** to authorisation endpoint( i.e. “https://\/authorize”) 2. Added an audience: https://\/mfa to the authorisation endpoint Then I make a post request to token endpoint with authorization code to get the mfa\_token. The only changes I can observe is now the access token(which I presume to be the mfa\_token) is in jwt format with expire time 600 sec. By using this access token(=mfa\_token) I built a custom pages for my user for enrollment and challenging the user via sms. I am able to enroll user, confirm enrollment using this access token. But when I challenge an user using this access token I get the following error after **https://YOUR\_DOMAIN/mfa/challenge** call. { “error”: “invalid\_grant”, “error\_description”: “Malformed mfa\_token” } Can anyone please say me where I am going wrong? Is the access token same as the MFA\_Token in my case? Thanks in Advance! ---
**Author:** ![rob.fyfe](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rob.fyfe/32/31744_2.png) [@rob.fyfe](https://community.auth0.com/u/rob.fyfe)\ **Post date:** [September 15, 2021, 4:40am UTC](https://community.auth0.com/t/malformed-mfa-token-message-when-trying-to-challenge-an-user-with-mfa/64112/2 "2021-09-15T04:40:29Z")
Hi, just wondering if you got anywhere with this issue? I am experiencing the exact same thing you have detailed above. Thanks in advance. ---
**Author:** ![roli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/roli/32/28688_2.png) [@roli](https://community.auth0.com/u/roli)\ **Post date:** [November 16, 2021, 1:33pm UTC](https://community.auth0.com/t/malformed-mfa-token-message-when-trying-to-challenge-an-user-with-mfa/64112/3 "2021-11-16T13:33:42Z")
Hi, I’ve been having the same issue with the same error response. The associate and confirm MFA endpoints are working but the challenge does not. Auth0 team, please reply on this topic. Thanks! ---
**Author:** ![srikanth.dyapa](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/srikanth.dyapa/32/33891_2.png) [@srikanth.dyapa](https://community.auth0.com/u/srikanth.dyapa)\ **Post date:** [January 13, 2022, 11:42pm UTC](https://community.auth0.com/t/malformed-mfa-token-message-when-trying-to-challenge-an-user-with-mfa/64112/4 "2022-01-13T23:42:51Z")
Anyone have any idea about this, I am getting same issue. ---
**Author:** ![hbrown](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/hbrown/32/35039_2.png) [@hbrown](https://community.auth0.com/u/hbrown)\ **Post date:** [June 2, 2022, 10:50pm UTC](https://community.auth0.com/t/malformed-mfa-token-message-when-trying-to-challenge-an-user-with-mfa/64112/5 "2022-06-02T22:50:27Z")
I am also stuck on this step. Have 3 factors set as active, but can’t get passed issuing a challenge: - What audience and scope is required for the MFA token for this endpoint: `/mfa/challenge` ---
**Author:** ![ron\_runviably](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ron_runviably/32/38611_2.png) [@ron\_runviably](https://community.auth0.com/u/ron_runviably)\ **Post date:** [July 6, 2022, 8:13pm UTC](https://community.auth0.com/t/malformed-mfa-token-message-when-trying-to-challenge-an-user-with-mfa/64112/6 "2022-07-06T20:13:03Z")
I have the exact same problem. I’m using the `https://YOUR_DOMAIN/mfa` audience and `enroll read:authenticators` scopes and getting the user to log in. I’m using the `access_token` returned in the callback as the MFA token (expires in 600 sec) and use it to enroll and list the authenticators - both works. But using the same MFA token to call the `/mfa/challenge` endpoint always fails with: ```auto { “error”: “invalid_grant”, “error_description”: “Malformed mfa_token” } ``` For now I’m by passing this by always enrolling the user again with the same phone number (for SMS) and then verifying it, it “works” but just feels wrong. Any help would be appreciated! ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [July 6, 2022, 11:46pm UTC](https://community.auth0.com/t/malformed-mfa-token-message-when-trying-to-challenge-an-user-with-mfa/64112/8 "2022-07-06T23:46:58Z")
Hello @ron_runviably thanks for the detailed description and welcome to the community! > [@ron\_runviably](#): > > I’m using the `https://YOUR_DOMAIN/mfa` audience and `enroll read:authenticators` scopes and getting the user to log in. I’d be curious to know how exactly you are authorizing the user here - Are you using [ROPG](https://auth0.com/docs/get-started/authentication-and-authorization-flow/call-your-api-using-resource-owner-password-flow#request-tokens) or a call to [/authorize](https://auth0.com/docs/api/authentication#authorize-application)? Let us know! ---
**Author:** ![ron\_runviably](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ron_runviably/32/38611_2.png) [@ron\_runviably](https://community.auth0.com/u/ron_runviably)\ **Post date:** [July 7, 2022, 6:02am UTC](https://community.auth0.com/t/malformed-mfa-token-message-when-trying-to-challenge-an-user-with-mfa/64112/10 "2022-07-07T06:02:19Z")
Hi @ty.frith and thanks for the reply. I’m using `express-oidc-connect` middleware in my `express` application and I’m calling the `oidc.login()` method, I know it redirects me to `/authorize`, so I’m guessing I’m not doing ROPG? After the user is logged in, I’m taking the `access_token` from the session, which like I mentioned works for enroll & list authenticators calls. From the application side, I’m using `regular web app` with `POST` as the `Token Endpoint Authentication Method` and passing both `client_id` and `client_secret` to the `/mfa/challenge` call. I’ve also tried both social login via Google and user-password login, which results in the same error `Malformed mfa_token`. ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [July 8, 2022, 12:51am UTC](https://community.auth0.com/t/malformed-mfa-token-message-when-trying-to-challenge-an-user-with-mfa/64112/11 "2022-07-08T00:51:59Z")
Thanks for all the info! It sounds like you don’t have MFA enabled at the tenant level (Dashboard → Security → Multi-factor Auth)? I believe you may need to have this enabled in order to receive an MFA token that can be used at `/mfa/challenge` . If MFA is enabled and you go to log a user in, you should receive an error like: ```auto { "error": "mfa_required", "error_description": "Multifactor authentication required", "mfa_token": "Fe26...Ha" } ``` This token _should_ work to challenge. You could also try adding `https://YOUR_DOMAIN/mfa/` as an audience, but I am not positive that will work either. ---
**Author:** ![ron\_runviably](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ron_runviably/32/38611_2.png) [@ron\_runviably](https://community.auth0.com/u/ron_runviably)\ **Post date:** [July 9, 2022, 6:46pm UTC](https://community.auth0.com/t/malformed-mfa-token-message-when-trying-to-challenge-an-user-with-mfa/64112/12 "2022-07-09T18:46:11Z")
Thanks, MFA is enabled. I’ve also contacted auth0 support via ticket about this, so I’m sharing what I was told. Basically, it seems that in order to get a void MFA token for `/mfa/challenge`, we must use ROPG. The `/authorize` endpoint with the audience and scopes is not enough, since once I pass the login there, I’m already considered login and have `access_token`, which allows me to enroll new MFA methods, but cannot be used as MFA token for the `/mfa/challenge` endpoint. It seems that to properly use MFA with the universal login, I can only customize the screens within auth0, I cannot implement my own flow in my app and use the API. ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [July 11, 2022, 11:48pm UTC](https://community.auth0.com/t/malformed-mfa-token-message-when-trying-to-challenge-an-user-with-mfa/64112/13 "2022-07-11T23:48:28Z")
Thanks a bunch for following up on this and sharing with the community! 😄 ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [July 26, 2022, 11:48pm UTC](https://community.auth0.com/t/malformed-mfa-token-message-when-trying-to-challenge-an-user-with-mfa/64112/14 "2022-07-26T23:48:58Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.