Request MFA Challenge

Request a challenge for multi-factor authentication. This endpoint is used during the MFA flow when a user needs to verify their identity using a second factor.

When to use: After receiving an mfa_required error from /oauth/token, use this endpoint to request a challenge (OTP or OOB) before completing authentication.

Challenge Types:

• otp - One-time password from authenticator app
• oob - Out-of-band via SMS, voice, or push notification

POST https://{yourDomain}/mfa/challenge

cURL

otpChallenge

curl --request POST \
  --url https://{yourDomain}/mfa/challenge \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "mfa_token": "Fe26...Ha",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET",
  "challenge_type": "otp"
}
'

200

otpResponse

{
  "challenge_type": "otp"
}

承認

Authorization · string · header · 必須

The access token received from the authorization server in the OAuth 2.0 flow.

ボディ

application/json

mfa_token · string · 必須

The MFA token received in the mfa_required error response from /oauth/token

client_id · string · 必須

Your application's Client ID

challenge_type · enum<string> · 必須

The type of MFA challenge to request

利用可能なオプション: otp, oob

client_secret · string

Your application's Client Secret (required for confidential clients)

authenticator_id · string

The ID of a specific authenticator to challenge (optional, for users with multiple MFA methods enrolled)

oob_channel · enum<string>

The channel to use for OOB challenges (required when challenge_type is 'oob')

利用可能なオプション: sms, voice, auth0

レスポンス

200

application/json

Challenge request successful

challenge_type · string

The type of challenge

oob_code · string

The OOB code to use when completing the challenge (for OOB challenges)

binding_method · string

The binding method for the OOB challenge