> ## Documentation Index > Fetch the complete documentation index at: https://docs-staging-quickstart-revamp.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. > Describes how to build your own MFA flows using SMS or voice as an authentication factor. # Enroll and Challenge Email Authenticators Auth0 provides a built-in MFA enrollment and authentication flow using [Universal Login](/docs/authenticate/login/auth0-universal-login). However, if you want to create your own user interface, you can use the [MFA API](/docs/secure/multi-factor-authentication/multi-factor-authentication-developer-resources/mfa-api) to accomplish it. When email is enabled as a factor, all users with verified emails will be able to use them to complete MFA. Both your specific login implementation and your Auth0 plan or custom agreement affect whether this feature is available. To learn more, read [Pricing](https://auth0.com/pricing). ## Prerequisites Before you can use the MFA APIs, you'll need to enable the MFA grant type for your application. Go to [Auth0 Dashboard > Applications > Advanced Settings > Grant Types](https://manage.auth0.com/#/applications) and select **MFA**. * [Configure Email](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-email-notifications-for-mfa) as a factor in the Dashboard or using the [Management API](https://auth0.com/docs/api/management/v2#!/Guardian/put_factors_by_name). ## Enroll with email To enable users to enroll emails in addition to their verified email in their primary identity, you need to complete the following steps. ### Get MFA token Depending on when you are triggering enrollment, you can obtain an access token for using the MFA API in different ways: * If you are enrolling during authentication, see [Authenticate With Resource Owner Password Grant and MFA](/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa). * If you want to let the user enroll a factor at any moment, see [Manage MFA Factor Enrollments](/docs/secure/multi-factor-authentication/manage-mfa-auth0-apis/manage-authenticator-factors-mfa-api). ### Enroll authenticator Make a `POST` request to the MFA Associate endpoint to enroll the user's authenticator. The bearer token required by this endpoint is the MFA token obtained in the previous step. Use the following parameters:
Parameter Value
authentication\_types \[oob]
oob\_channels \[email]
email [email@address.com](mailto:email@address.com), the users email address.
```bash cURL lines curl --request POST \ --url 'https://{yourDomain}/mfa/associate' \ --header 'authorization: Bearer MFA_TOKEN' \ --header 'content-type: application/json' \ --data '{ "authenticator_types": ["oob"], "oob_channels": ["email"], "email" : "email@address.com" }' ``` ```csharp C# lines var client = new RestClient("https://{yourDomain}/mfa/associate"); var request = new RestRequest(Method.POST); request.AddHeader("authorization", "Bearer MFA_TOKEN"); request.AddHeader("content-type", "application/json"); request.AddParameter("application/json", "{ \"authenticator_types\": [\"oob\"], \"oob_channels\": [\"email\"], \"email\" : \"email@address.com\" }", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```go Go lines expandable package main import ( "fmt" "strings" "net/http" "io/ioutil" ) func main() { url := "https://{yourDomain}/mfa/associate" payload := strings.NewReader("{ \"authenticator_types\": [\"oob\"], \"oob_channels\": [\"email\"], \"email\" : \"email@address.com\" }") req, _ := http.NewRequest("POST", url, payload) req.Header.Add("authorization", "Bearer MFA_TOKEN") req.Header.Add("content-type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := ioutil.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```java Java lines HttpResponse response = Unirest.post("https://{yourDomain}/mfa/associate") .header("authorization", "Bearer MFA_TOKEN") .header("content-type", "application/json") .body("{ \"authenticator_types\": [\"oob\"], \"oob_channels\": [\"email\"], \"email\" : \"email@address.com\" }") .asString(); ``` ```javascript Node.JS lines var axios = require("axios").default; var options = { method: 'POST', url: 'https://{yourDomain}/mfa/associate', headers: {authorization: 'Bearer MFA_TOKEN', 'content-type': 'application/json'}, data: { authenticator_types: ['oob'], oob_channels: ['email'], email: 'email@address.com' } }; axios.request(options).then(function (response) { console.log(response.data); }).catch(function (error) { console.error(error); }); ``` ```obj-c Obj-C lines expandable #import NSDictionary *headers = @{ @"authorization": @"Bearer MFA_TOKEN", @"content-type": @"application/json" }; NSDictionary *parameters = @{ @"authenticator_types": @[ @"oob" ], @"oob_channels": @[ @"email" ], @"email": @"email@address.com" }; NSData *postData = [NSJSONSerialization dataWithJSONObject:parameters options:0 error:nil]; NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:@"https://{yourDomain}/mfa/associate"] cachePolicy:NSURLRequestUseProtocolCachePolicy timeoutInterval:10.0]; [request setHTTPMethod:@"POST"]; [request setAllHTTPHeaderFields:headers]; [request setHTTPBody:postData]; NSURLSession *session = [NSURLSession sharedSession]; NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:request completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) { if (error) { NSLog(@"%@", error); } else { NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *) response; NSLog(@"%@", httpResponse); } }]; [dataTask resume]; ``` ```php PHP lines expandable $curl = curl_init(); curl_setopt_array($curl, [ CURLOPT_URL => "https://{yourDomain}/mfa/associate", CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => "", CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 30, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "POST", CURLOPT_POSTFIELDS => "{ \"authenticator_types\": [\"oob\"], \"oob_channels\": [\"email\"], \"email\" : \"email@address.com\" }", CURLOPT_HTTPHEADER => [ "authorization: Bearer MFA_TOKEN", "content-type: application/json" ], ]); $response = curl_exec($curl); $err = curl_error($curl); curl_close($curl); if ($err) { echo "cURL Error #:" . $err; } else { echo $response; } ``` ```python Python lines import http.client conn = http.client.HTTPSConnection("") payload = "{ \"authenticator_types\": [\"oob\"], \"oob_channels\": [\"email\"], \"email\" : \"email@address.com\" }" headers = { 'authorization': "Bearer MFA_TOKEN", 'content-type': "application/json" } conn.request("POST", "/{yourDomain}/mfa/associate", payload, headers) res = conn.getresponse() data = res.read() print(data.decode("utf-8")) ``` ```ruby Ruby lines require 'uri' require 'net/http' require 'openssl' url = URI("https://{yourDomain}/mfa/associate") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_NONE request = Net::HTTP::Post.new(url) request["authorization"] = 'Bearer MFA_TOKEN' request["content-type"] = 'application/json' request.body = "{ \"authenticator_types\": [\"oob\"], \"oob_channels\": [\"email\"], \"email\" : \"email@address.com\" }" response = http.request(request) puts response.read_body ``` ```swift Swift lines expandable import Foundation let headers = [ "authorization": "Bearer MFA_TOKEN", "content-type": "application/json" ] let parameters = [ "authenticator_types": ["oob"], "oob_channels": ["email"], "email": "email@address.com" ] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://{yourDomain}/mfa/associate")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ``` If successful, you receive a response like this: ```json lines { "authenticator_type": "oob", "binding_method": "prompt", "oob_code" : "Fe26..nWE", "oob_channel": "email", "recovery_codes": [ "N3BGPZZWJ85JLCNPZBDW6QXC" ] } ``` If you get a `User is already enrolled` error, the user already has an MFA factor enrolled. Before associating another factor with the user, you must challenge the user with the existing factor. If this is the first time the user is associating an authenticator, you'll notice the response includes `recovery_codes`. Recovery codes are used to access the user's account in the event that they lose access to the account or device used for their second-factor authentication. These are one-time usable codes, and new ones are generated as necessary. ### Confirm email enrollment The user should receive an email containing the 6-digit code that they can provide to the application. To complete the enrollment, make a `POST` request to the [**`/oath/token`**](https://auth0.com/docs/api/authentication#get-token) endpoint. Include the `oob_code` returned in the previous response and the `binding_code` with the value in the email message. ```bash cURL lines curl --request POST \ --url 'https://{yourDomain}/oauth/token' \ --data grant_type=http://auth0.com/oauth/grant-type/mfa-oob \ --data 'mfa_token={mfaToken}' \ --data 'oob_code={oobCode}' \ --data 'binding_code={userEmailOtpCode}' \ --data 'client_id={yourClientId}' \ --data 'client_secret={yourClientSecret}' ``` ```csharp C# lines var client = new RestClient("https://{yourDomain}/oauth/token"); var request = new RestRequest(Method.POST); request.AddParameter("undefined", "grant_type=http%3A%2F%2Fauth0.com%2Foauth%2Fgrant-type%2Fmfa-oob&mfa_token=%7BmfaToken%7D&oob_code=%7BoobCode%7D&binding_code=%7BuserEmailOtpCode%7D&client_id={yourClientId}&client_secret=%7ByourClientSecret%7D", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```go Go lines expandable package main import ( "fmt" "strings" "net/http" "io/ioutil" ) func main() { url := "https://{yourDomain}/oauth/token" payload := strings.NewReader("grant_type=http%3A%2F%2Fauth0.com%2Foauth%2Fgrant-type%2Fmfa-oob&mfa_token=%7BmfaToken%7D&oob_code=%7BoobCode%7D&binding_code=%7BuserEmailOtpCode%7D&client_id={yourClientId}&client_secret=%7ByourClientSecret%7D") req, _ := http.NewRequest("POST", url, payload) res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := ioutil.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```java Java lines HttpResponse response = Unirest.post("https://{yourDomain}/oauth/token") .body("grant_type=http%3A%2F%2Fauth0.com%2Foauth%2Fgrant-type%2Fmfa-oob&mfa_token=%7BmfaToken%7D&oob_code=%7BoobCode%7D&binding_code=%7BuserEmailOtpCode%7D&client_id={yourClientId}&client_secret=%7ByourClientSecret%7D") .asString(); ``` ```javascript Node.JS lines var axios = require("axios").default; var options = { method: 'POST', url: 'https://{yourDomain}/oauth/token', data: new URLSearchParams({ grant_type: 'http://auth0.com/oauth/grant-type/mfa-oob', mfa_token: '{mfaToken}', oob_code: '{oobCode}', binding_code: '{userEmailOtpCode}', client_id: '{yourClientId}', client_secret: '{yourClientSecret}' }) }; axios.request(options).then(function (response) { console.log(response.data); }).catch(function (error) { console.error(error); }); ``` ```obj-c Obj-C lines expandable #import NSMutableData *postData = [[NSMutableData alloc] initWithData:[@"grant_type=http://auth0.com/oauth/grant-type/mfa-oob" dataUsingEncoding:NSUTF8StringEncoding]]; [postData appendData:[@"&mfa_token={mfaToken}" dataUsingEncoding:NSUTF8StringEncoding]]; [postData appendData:[@"&oob_code={oobCode}" dataUsingEncoding:NSUTF8StringEncoding]]; [postData appendData:[@"&binding_code={userEmailOtpCode}" dataUsingEncoding:NSUTF8StringEncoding]]; [postData appendData:[@"&client_id={yourClientId}" dataUsingEncoding:NSUTF8StringEncoding]]; [postData appendData:[@"&client_secret={yourClientSecret}" dataUsingEncoding:NSUTF8StringEncoding]]; NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:@"https://{yourDomain}/oauth/token"] cachePolicy:NSURLRequestUseProtocolCachePolicy timeoutInterval:10.0]; [request setHTTPMethod:@"POST"]; [request setHTTPBody:postData]; NSURLSession *session = [NSURLSession sharedSession]; NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:request completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) { if (error) { NSLog(@"%@", error); } else { NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *) response; NSLog(@"%@", httpResponse); } }]; [dataTask resume]; ``` ```php PHP lines $curl = curl_init(); curl_setopt_array($curl, [ CURLOPT_URL => "https://{yourDomain}/oauth/token", CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => "", CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 30, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "POST", CURLOPT_POSTFIELDS => "grant_type=http%3A%2F%2Fauth0.com%2Foauth%2Fgrant-type%2Fmfa-oob&mfa_token=%7BmfaToken%7D&oob_code=%7BoobCode%7D&binding_code=%7BuserEmailOtpCode%7D&client_id={yourClientId}&client_secret=%7ByourClientSecret%7D", ]); $response = curl_exec($curl); $err = curl_error($curl); curl_close($curl); if ($err) { echo "cURL Error #:" . $err; } else { echo $response; } ``` ```python Python lines import http.client conn = http.client.HTTPSConnection("") payload = "grant_type=http%3A%2F%2Fauth0.com%2Foauth%2Fgrant-type%2Fmfa-oob&mfa_token=%7BmfaToken%7D&oob_code=%7BoobCode%7D&binding_code=%7BuserEmailOtpCode%7D&client_id={yourClientId}&client_secret=%7ByourClientSecret%7D" conn.request("POST", "/{yourDomain}/oauth/token", payload) res = conn.getresponse() data = res.read() print(data.decode("utf-8")) ``` ```ruby Ruby lines require 'uri' require 'net/http' require 'openssl' url = URI("https://{yourDomain}/oauth/token") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_NONE request = Net::HTTP::Post.new(url) request.body = "grant_type=http%3A%2F%2Fauth0.com%2Foauth%2Fgrant-type%2Fmfa-oob&mfa_token=%7BmfaToken%7D&oob_code=%7BoobCode%7D&binding_code=%7BuserEmailOtpCode%7D&client_id={yourClientId}&client_secret=%7ByourClientSecret%7D" response = http.request(request) puts response.read_body ``` ```swift Swift lines expandable import Foundation let postData = NSMutableData(data: "grant_type=http://auth0.com/oauth/grant-type/mfa-oob".data(using: String.Encoding.utf8)!) postData.append("&mfa_token={mfaToken}".data(using: String.Encoding.utf8)!) postData.append("&oob_code={oobCode}".data(using: String.Encoding.utf8)!) postData.append("&binding_code={userEmailOtpCode}".data(using: String.Encoding.utf8)!) postData.append("&client_id={yourClientId}".data(using: String.Encoding.utf8)!) postData.append("&client_secret={yourClientSecret}".data(using: String.Encoding.utf8)!) let request = NSMutableURLRequest(url: NSURL(string: "https://{yourDomain}/oauth/token")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ``` If the call was successful, you'll receive a response in the following format, containing the access token: ```json lines { "id_token": "eyJ...i", "access_token": "eyJ...i", "expires_in": 600, "scope": "openid profile", "token_type": "Bearer" } ``` At this point, the authenticator is fully associated and ready to be used, and you have the authentication tokens for the user. You can check at any point to verify whether an authenticator has been confirmed by calling the MFA Authenticators endpoint. If the authenticator is confirmed, the value returned for `active` is `true`. Optionally, you can customize the emails that users receive. See [Customize Email Templates](/docs/customize/email/email-templates) for details. ## Challenge with email ### Get MFA token Get an MFA token following the steps described in [Authenticate With Resource Owner Password Grant and MFA](/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa). ### Retrieve enrolled authenticators To challenge the user, you need the `authenticator_id` for the factor you want to challenge. You can list all enrolled authenticators using the MFA Authenticators endpoint: ```bash cURL lines curl --request GET \ --url 'https://{yourDomain}/mfa/authenticators' \ --header 'authorization: Bearer MFA_TOKEN' \ --header 'content-type: application/json' ``` ```csharp C# lines var client = new RestClient("https://{yourDomain}/mfa/authenticators"); var request = new RestRequest(Method.GET); request.AddHeader("authorization", "Bearer MFA_TOKEN"); request.AddHeader("content-type", "application/json"); IRestResponse response = client.Execute(request); ``` ```go Go lines expandable package main import ( "fmt" "net/http" "io/ioutil" ) func main() { url := "https://{yourDomain}/mfa/authenticators" req, _ := http.NewRequest("GET", url, nil) req.Header.Add("authorization", "Bearer MFA_TOKEN") req.Header.Add("content-type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := ioutil.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```java Java lines HttpResponse response = Unirest.get("https://{yourDomain}/mfa/authenticators") .header("authorization", "Bearer MFA_TOKEN") .header("content-type", "application/json") .asString(); ``` ```javascript Node.JS lines var axios = require("axios").default; var options = { method: 'GET', url: 'https://{yourDomain}/mfa/authenticators', headers: {authorization: 'Bearer MFA_TOKEN', 'content-type': 'application/json'} }; axios.request(options).then(function (response) { console.log(response.data); }).catch(function (error) { console.error(error); }); ``` ```obj-c Obj-C lines #import NSDictionary *headers = @{ @"authorization": @"Bearer MFA_TOKEN", @"content-type": @"application/json" }; NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:@"https://{yourDomain}/mfa/authenticators"] cachePolicy:NSURLRequestUseProtocolCachePolicy timeoutInterval:10.0]; [request setHTTPMethod:@"GET"]; [request setAllHTTPHeaderFields:headers]; NSURLSession *session = [NSURLSession sharedSession]; NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:request completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) { if (error) { NSLog(@"%@", error); } else { NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *) response; NSLog(@"%@", httpResponse); } }]; [dataTask resume]; ``` ```php PHP lines expandable $curl = curl_init(); curl_setopt_array($curl, [ CURLOPT_URL => "https://{yourDomain}/mfa/authenticators", CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => "", CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 30, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "GET", CURLOPT_HTTPHEADER => [ "authorization: Bearer MFA_TOKEN", "content-type: application/json" ], ]); $response = curl_exec($curl); $err = curl_error($curl); curl_close($curl); if ($err) { echo "cURL Error #:" . $err; } else { echo $response; } ``` ```python Python lines import http.client conn = http.client.HTTPSConnection("") headers = { 'authorization': "Bearer MFA_TOKEN", 'content-type': "application/json" } conn.request("GET", "/{yourDomain}/mfa/authenticators", headers=headers) res = conn.getresponse() data = res.read() print(data.decode("utf-8")) ``` ```ruby Ruby lines require 'uri' require 'net/http' require 'openssl' url = URI("https://{yourDomain}/mfa/authenticators") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_NONE request = Net::HTTP::Get.new(url) request["authorization"] = 'Bearer MFA_TOKEN' request["content-type"] = 'application/json' response = http.request(request) puts response.read_body ``` ```swift Swift lines import Foundation let headers = [ "authorization": "Bearer MFA_TOKEN", "content-type": "application/json" ] let request = NSMutableURLRequest(url: NSURL(string: "https://{yourDomain}/mfa/authenticators")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "GET" request.allHTTPHeaderFields = headers let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ``` ### Challenge user with OTP To trigger an email challenge, `POST` to the MFA Challenge endpoint using the corresponding `authenticator_id` and the `mfa_token`. ```bash cURL lines curl --request POST \ --url 'https://{yourDomain}/mfa/challenge' \ --data '{ "client_id": "{yourClientId}", "client_secret": "{yourClientSecret}", "challenge_type": "oob", "authenticator_id": "email|dev_NU1Ofuw3Cw0XCt5x", "mfa_token": "{mfaToken}" }' ``` ```csharp C# lines var client = new RestClient("https://{yourDomain}/mfa/challenge"); var request = new RestRequest(Method.POST); request.AddParameter("undefined", "{ \"client_id\": \"{yourClientId}\", \"client_secret\": \"{yourClientSecret}\", \"challenge_type\": \"oob\", \"authenticator_id\": \"email|dev_NU1Ofuw3Cw0XCt5x\", \"mfa_token\": \"{mfaToken}\" }", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```go Go lines expandable package main import ( "fmt" "strings" "net/http" "io/ioutil" ) func main() { url := "https://{yourDomain}/mfa/challenge" payload := strings.NewReader("{ \"client_id\": \"{yourClientId}\", \"client_secret\": \"{yourClientSecret}\", \"challenge_type\": \"oob\", \"authenticator_id\": \"email|dev_NU1Ofuw3Cw0XCt5x\", \"mfa_token\": \"{mfaToken}\" }") req, _ := http.NewRequest("POST", url, payload) res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := ioutil.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```java Java lines HttpResponse response = Unirest.post("https://{yourDomain}/mfa/challenge") .body("{ \"client_id\": \"{yourClientId}\", \"client_secret\": \"{yourClientSecret}\", \"challenge_type\": \"oob\", \"authenticator_id\": \"email|dev_NU1Ofuw3Cw0XCt5x\", \"mfa_token\": \"{mfaToken}\" }") .asString(); ``` ```javascript Node.JS lines var axios = require("axios").default; var options = { method: 'POST', url: 'https://{yourDomain}/mfa/challenge', data: { client_id: '{yourClientId}', client_secret: '{yourClientSecret}', challenge_type: 'oob', authenticator_id: 'email|dev_NU1Ofuw3Cw0XCt5x', mfa_token: '{mfaToken}' } }; axios.request(options).then(function (response) { console.log(response.data); }).catch(function (error) { console.error(error); }); ``` ```obj-c Obj-C lines expandable #import NSDictionary *parameters = @{ @"client_id": @"{yourClientId}", @"client_secret": @"{yourClientSecret}", @"challenge_type": @"oob", @"authenticator_id": @"email|dev_NU1Ofuw3Cw0XCt5x", @"mfa_token": @"{mfaToken}" }; NSData *postData = [NSJSONSerialization dataWithJSONObject:parameters options:0 error:nil]; NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:@"https://{yourDomain}/mfa/challenge"] cachePolicy:NSURLRequestUseProtocolCachePolicy timeoutInterval:10.0]; [request setHTTPMethod:@"POST"]; [request setHTTPBody:postData]; NSURLSession *session = [NSURLSession sharedSession]; NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:request completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) { if (error) { NSLog(@"%@", error); } else { NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *) response; NSLog(@"%@", httpResponse); } }]; [dataTask resume]; ``` ```php PHP lines $curl = curl_init(); curl_setopt_array($curl, [ CURLOPT_URL => "https://{yourDomain}/mfa/challenge", CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => "", CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 30, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "POST", CURLOPT_POSTFIELDS => "{ \"client_id\": \"{yourClientId}\", \"client_secret\": \"{yourClientSecret}\", \"challenge_type\": \"oob\", \"authenticator_id\": \"email|dev_NU1Ofuw3Cw0XCt5x\", \"mfa_token\": \"{mfaToken}\" }", ]); $response = curl_exec($curl); $err = curl_error($curl); curl_close($curl); if ($err) { echo "cURL Error #:" . $err; } else { echo $response; } ``` ```python Python lines import http.client conn = http.client.HTTPSConnection("") payload = "{ \"client_id\": \"{yourClientId}\", \"client_secret\": \"{yourClientSecret}\", \"challenge_type\": \"oob\", \"authenticator_id\": \"email|dev_NU1Ofuw3Cw0XCt5x\", \"mfa_token\": \"{mfaToken}\" }" conn.request("POST", "/{yourDomain}/mfa/challenge", payload) res = conn.getresponse() data = res.read() print(data.decode("utf-8")) ``` ```ruby Ruby lines require 'uri' require 'net/http' require 'openssl' url = URI("https://{yourDomain}/mfa/challenge") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_NONE request = Net::HTTP::Post.new(url) request.body = "{ \"client_id\": \"{yourClientId}\", \"client_secret\": \"{yourClientSecret}\", \"challenge_type\": \"oob\", \"authenticator_id\": \"email|dev_NU1Ofuw3Cw0XCt5x\", \"mfa_token\": \"{mfaToken}\" }" response = http.request(request) puts response.read_body ``` ```swift Swift lines expandable import Foundation let parameters = [ "client_id": "{yourClientId}", "client_secret": "{yourClientSecret}", "challenge_type": "oob", "authenticator_id": "email|dev_NU1Ofuw3Cw0XCt5x", "mfa_token": "{mfaToken}" ] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://{yourDomain}/mfa/challenge")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ``` ### Complete authentication using received code If successful, you receive the following response: ```json lines { "challenge_type": "oob", "oob_code": "abcd1234...", "binding_method": "prompt" } ``` Your application should prompt the user for the code and send it as part of the request in the `binding_code` parameter in the following call to the `oauth``/token` endpoint: ```bash cURL lines curl --request POST \ --url 'https://{yourDomain}/oauth/token' \ --header 'content-type: application/x-www-form-urlencoded' \ --data grant_type=http://auth0.com/oauth/grant-type/mfa-oob \ --data 'client_id={yourClientId}' \ --data 'client_secret={yourClientSecret}' \ --data 'mfa_token={mfaToken}' \ --data 'oob_code={oobCode}' \ --data 'binding_code={userEmailOtpCode}' ``` ```csharp C# lines var client = new RestClient("https://{yourDomain}/oauth/token"); var request = new RestRequest(Method.POST); request.AddHeader("content-type", "application/x-www-form-urlencoded"); request.AddParameter("application/x-www-form-urlencoded", "grant_type=http%3A%2F%2Fauth0.com%2Foauth%2Fgrant-type%2Fmfa-oob&client_id={yourClientId}&client_secret=%7ByourClientSecret%7D&mfa_token=%7BmfaToken%7D&oob_code=%7BoobCode%7D&binding_code=%7BuserEmailOtpCode%7D", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```go Go lines expandable package main import ( "fmt" "strings" "net/http" "io/ioutil" ) func main() { url := "https://{yourDomain}/oauth/token" payload := strings.NewReader("grant_type=http%3A%2F%2Fauth0.com%2Foauth%2Fgrant-type%2Fmfa-oob&client_id={yourClientId}&client_secret=%7ByourClientSecret%7D&mfa_token=%7BmfaToken%7D&oob_code=%7BoobCode%7D&binding_code=%7BuserEmailOtpCode%7D") req, _ := http.NewRequest("POST", url, payload) req.Header.Add("content-type", "application/x-www-form-urlencoded") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := ioutil.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```java Java lines HttpResponse response = Unirest.post("https://{yourDomain}/oauth/token") .header("content-type", "application/x-www-form-urlencoded") .body("grant_type=http%3A%2F%2Fauth0.com%2Foauth%2Fgrant-type%2Fmfa-oob&client_id={yourClientId}&client_secret=%7ByourClientSecret%7D&mfa_token=%7BmfaToken%7D&oob_code=%7BoobCode%7D&binding_code=%7BuserEmailOtpCode%7D") .asString(); ``` ```javascript Node.JS lines var axios = require("axios").default; var options = { method: 'POST', url: 'https://{yourDomain}/oauth/token', headers: {'content-type': 'application/x-www-form-urlencoded'}, data: new URLSearchParams({ grant_type: 'http://auth0.com/oauth/grant-type/mfa-oob', client_id: '{yourClientId}', client_secret: '{yourClientSecret}', mfa_token: '{mfaToken}', oob_code: '{oobCode}', binding_code: '{userEmailOtpCode}' }) }; axios.request(options).then(function (response) { console.log(response.data); }).catch(function (error) { console.error(error); }); ``` ```obj-c Obj-C lines expandable #import NSDictionary *headers = @{ @"content-type": @"application/x-www-form-urlencoded" }; NSMutableData *postData = [[NSMutableData alloc] initWithData:[@"grant_type=http://auth0.com/oauth/grant-type/mfa-oob" dataUsingEncoding:NSUTF8StringEncoding]]; [postData appendData:[@"&client_id={yourClientId}" dataUsingEncoding:NSUTF8StringEncoding]]; [postData appendData:[@"&client_secret={yourClientSecret}" dataUsingEncoding:NSUTF8StringEncoding]]; [postData appendData:[@"&mfa_token={mfaToken}" dataUsingEncoding:NSUTF8StringEncoding]]; [postData appendData:[@"&oob_code={oobCode}" dataUsingEncoding:NSUTF8StringEncoding]]; [postData appendData:[@"&binding_code={userEmailOtpCode}" dataUsingEncoding:NSUTF8StringEncoding]]; NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:@"https://{yourDomain}/oauth/token"] cachePolicy:NSURLRequestUseProtocolCachePolicy timeoutInterval:10.0]; [request setHTTPMethod:@"POST"]; [request setAllHTTPHeaderFields:headers]; [request setHTTPBody:postData]; NSURLSession *session = [NSURLSession sharedSession]; NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:request completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) { if (error) { NSLog(@"%@", error); } else { NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *) response; NSLog(@"%@", httpResponse); } }]; [dataTask resume]; ``` ```php PHP lines expandable $curl = curl_init(); curl_setopt_array($curl, [ CURLOPT_URL => "https://{yourDomain}/oauth/token", CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => "", CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 30, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "POST", CURLOPT_POSTFIELDS => "grant_type=http%3A%2F%2Fauth0.com%2Foauth%2Fgrant-type%2Fmfa-oob&client_id={yourClientId}&client_secret=%7ByourClientSecret%7D&mfa_token=%7BmfaToken%7D&oob_code=%7BoobCode%7D&binding_code=%7BuserEmailOtpCode%7D", CURLOPT_HTTPHEADER => [ "content-type: application/x-www-form-urlencoded" ], ]); $response = curl_exec($curl); $err = curl_error($curl); curl_close($curl); if ($err) { echo "cURL Error #:" . $err; } else { echo $response; } ``` ```python Python lines import http.client conn = http.client.HTTPSConnection("") payload = "grant_type=http%3A%2F%2Fauth0.com%2Foauth%2Fgrant-type%2Fmfa-oob&client_id={yourClientId}&client_secret=%7ByourClientSecret%7D&mfa_token=%7BmfaToken%7D&oob_code=%7BoobCode%7D&binding_code=%7BuserEmailOtpCode%7D" headers = { 'content-type': "application/x-www-form-urlencoded" } conn.request("POST", "/{yourDomain}/oauth/token", payload, headers) res = conn.getresponse() data = res.read() print(data.decode("utf-8")) ``` ```ruby Ruby lines require 'uri' require 'net/http' require 'openssl' url = URI("https://{yourDomain}/oauth/token") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_NONE request = Net::HTTP::Post.new(url) request["content-type"] = 'application/x-www-form-urlencoded' request.body = "grant_type=http%3A%2F%2Fauth0.com%2Foauth%2Fgrant-type%2Fmfa-oob&client_id={yourClientId}&client_secret=%7ByourClientSecret%7D&mfa_token=%7BmfaToken%7D&oob_code=%7BoobCode%7D&binding_code=%7BuserEmailOtpCode%7D" response = http.request(request) puts response.read_body ``` ```swift Swift lines expandable import Foundation let headers = ["content-type": "application/x-www-form-urlencoded"] let postData = NSMutableData(data: "grant_type=http://auth0.com/oauth/grant-type/mfa-oob".data(using: String.Encoding.utf8)!) postData.append("&client_id={yourClientId}".data(using: String.Encoding.utf8)!) postData.append("&client_secret={yourClientSecret}".data(using: String.Encoding.utf8)!) postData.append("&mfa_token={mfaToken}".data(using: String.Encoding.utf8)!) postData.append("&oob_code={oobCode}".data(using: String.Encoding.utf8)!) postData.append("&binding_code={userEmailOtpCode}".data(using: String.Encoding.utf8)!) let request = NSMutableURLRequest(url: NSURL(string: "https://{yourDomain}/oauth/token")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ``` If the call was successful, you'll receive a response in the format below, containing the access token: ```json lines { "id_token": "eyJ...i", "access_token": "eyJ...i", "expires_in": 600, "scope": "openid profile", "token_type": "Bearer" } ``` ## Learn more * [Manage Authentication Factors with Authentication API](/docs/secure/multi-factor-authentication/manage-mfa-auth0-apis/manage-authenticator-factors-mfa-api) * [Challenge with Recovery Codes](/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/challenge-with-recovery-codes) * [Enroll and Challenge OTP Authenticators](/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/enroll-and-challenge-otp-authenticators) * [Enroll and Challenge Push Authenticators](/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/enroll-and-challenge-push-authenticators) * [Enroll and Challenge SMS and Voice Authenticators](/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/enroll-challenge-sms-voice-authenticators)