MFA token expiry?

[thankfulpanda]

Hello, community!

I’m looking at the docs to obtain a MFA token:

To call the MFA API to manage enrollments, you first need to obtain an access token for the MFA API … If you are building a user interface to manage authentication factors, you’ll need to obtain a token you can use for the MFA API at any moment, not only during authentication.

https://auth0.com/docs/mfa/authenticate-with-ropg-and-mfa/manage-authenticator-factors-mfa-api#universal-login

I’m particularly interested in obtaining an MFA token via Universal Login.

Is there an expiration for the MFA token obtained through Universal Login? Can I store the token in my database for long-term use? What are the scenarios in which an MFA token can be invalidated?

Thanks for your help.

[dan.woda]

Hi @thankfulpanda,

Welcome to the Community!

It looks like they should have a 10 minute expiry, according to the following post. Are you experiencing other behavior?

Default /mfa/ audience's token expiration time

Access tokens with AUTH0_DOMAIN/mfa audience are restricted to 10 minutes expiry due to security reasons. This cannot be bypassed. I would use that audience only when the MFA scopes are explicitly required, and use a different or no audience otherwise.

[thankfulpanda]

Hi @dan.woda,

Thank you for the quick response and for the info!

I eventually did not proceed in this direction, so I didn’t check the expiry in practice.

I instead ended up using the enroll/delete/get MFA enrollment APIs available in the Guardian and the User sections in the Auth0 Management API. These APIs suited my needs equally well.

https://auth0.com/docs/api/management/v2#!/Guardian/delete_enrollments_by_id

[dan.woda]

Thanks for the update. I will mark that as the solution.