npx skills add ...
npx skills add auth0/agent-skills --skill auth0-mfa
npx skills add auth0/agent-skills --skill auth0-mfa
Use when adding MFA or step-up authentication to an app — requiring users to verify with a second factor (TOTP, SMS, passkey, push) for login or before a sensitive action. Also use for adaptive/risk-based MFA or compliance requirements like HIPAA or PCI-DSS, even if the user just says "add two-factor auth" or "require MFA before this action".
Add Multi-Factor Authentication to protect user accounts and require additional verification for sensitive operations.
Multi-Factor Authentication (MFA) requires users to provide two or more verification factors to access their accounts. Auth0 supports multiple MFA factors and enables step-up authentication for sensitive operations.
| Factor | Type | Description |
|---|---|---|
| TOTP | Something you have | Time-based one-time passwords (Google Authenticator, Authy) |
| SMS | Something you have | One-time codes via text message |
| Something you have | One-time codes via email | |
| Push | Something you have | Push notifications via Auth0 Guardian app |
| WebAuthn | Something you have/are | Security keys, biometrics, passkeys |
| Voice | Something you have | One-time codes via phone call |
| Recovery Code | Backup | One-time use recovery codes |
| Concept | Description |
|---|---|
acr_values | Request MFA during authentication |
amr claim | Authentication Methods Reference - indicates how user authenticated |
| Step-up auth | Require MFA for specific actions after initial login |
| Adaptive MFA | Conditionally require MFA based on risk signals |
Step-up auth requires MFA for sensitive operations without requiring it for every login.
acr_values ParameterRequest MFA by including acr_values in your authorization request:
The general pattern for all frameworks:
amr claim)acr_values parameterFor complete framework-specific examples, see Examples Guide [blocked]:
This skill is split into multiple files for better organization:
Complete code examples for all frameworks:
Learn how to validate MFA status on your backend:
Advanced MFA implementation patterns:
Common patterns and troubleshooting:
auth0-quickstart - Basic Auth0 setupauth0-passkeys - WebAuthn/passkey implementationauth0-actions - Custom authentication logic# Set MFA policy: "all-applications" or "confidence-score"
auth0 api patch "guardian/policies" --data '["all-applications"]'acr_values=http://schemas.openid.net/pape/policies/2007/06/multi-factor