# Scopes for Step-Up authentication

**URL:** <https://community.auth0.com/t/scopes-for-step-up-authentication/8763>\
**Category:** Get Help\
**Tags:** single-page-applicat, scopes, authentication, mfa\
**Created:** [November 17, 2017, 1:31am UTC](https://community.auth0.com/t/scopes-for-step-up-authentication/8763 "2017-11-17T01:31:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![alexander.korvyakov](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/alexander.korvyakov/32/7444_2.png) [@alexander.korvyakov](https://community.auth0.com/u/alexander.korvyakov)\
**Post date:** [November 17, 2017, 1:31am UTC](https://community.auth0.com/t/scopes-for-step-up-authentication/8763/1 "2017-11-17T01:31:08Z")

</div>

I want to add Step-Up authentication to my single-page web application that uses Auth0 lock widget.  
The MFA should be triggered on certain action e.g. “Sign contract”.

In Auth0 documentation I have found two ways to do that:

- scope: ‘openid step\_up’ that is described [here](https://auth0.com/docs/multifactor-authentication/custom-mfa-rules)
- scope: ‘openid nonce’, acr\_values: ‘[http://schemas.openid.net/pape/policies/2007/06/multi-factor](http://schemas.openid.net/pape/policies/2007/06/multi-factor)’ that I found in [this example](https://github.com/auth0/guardian-example/blob/master/client/containers/StepUp/index.js).

Could you please explain what is the difference and which one is preferable for single-page web app.

---

<div class="post-metadata">

**Author:** ![jmangelo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jmangelo/32/7923_2.png) [@jmangelo](https://community.auth0.com/u/jmangelo)\
**Post date:** [November 20, 2017, 10:50pm UTC](https://community.auth0.com/t/scopes-for-step-up-authentication/8763/2 "2017-11-20T22:50:36Z")

</div>

As somewhat hinted in the notice available in the first link you mentioned given that `acr_values` are now supported that should be your choice as they are standardized while the `step_up` flag was a custom implementation. In addition, to my knowledge the fact that the client application is a SPA should not affect this decision in any way.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 2, 2018, 5:57am UTC](https://community.auth0.com/t/scopes-for-step-up-authentication/8763/3 "2018-03-02T05:57:27Z")

</div>