56 results available

auth0-mfa

auth0

·

Last changed

Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening applied 2 targeted changes and preserved all other text. Classified findings before hardening: 3. Classified findings closed: 0. Classified findings remaining: 3. Unclassified scanner findings remaining: 0. Review findings closed: 3. Review findings remaining: 11.

Open before hardening

1

Medium

2

Low

Open after hardening

1

Medium

2

Low

File	Group	Subtype	Severity	Status
references/advanced.md	Sensitive Data & Secret Exposure	Data exfiltration	Medium	Open
references/backend.md	Sensitive Data & Secret Exposure	Hardcoded secret	Low	Open
references/examples.md	Prompt Injection	Third-party content as instructions	Low	Open

3 findings

SKILL.md

Auth0 MFA Guide

Add Multi-Factor Authentication to protect user accounts and require additional verification for sensitive operations.

Overview

What is MFA?

Multi-Factor Authentication (MFA) requires users to provide two or more verification factors to access their accounts. Auth0 supports multiple MFA factors and enables step-up authentication for sensitive operations.

When to Use This Skill

Adding MFA to protect user accounts
Requiring additional verification for sensitive actions (payments, settings changes)
Implementing adaptive/risk-based authentication
Meeting compliance requirements (PCI-DSS, SOC2, HIPAA)

MFA Factors Supported

Factor	Type	Description
TOTP	Something you have	Time-based one-time passwords (Google Authenticator, Authy)
SMS	Something you have	One-time codes via text message
Email	Something you have	One-time codes via email
Push	Something you have	Push notifications via Auth0 Guardian app
WebAuthn	Something you have/are	Security keys, biometrics, passkeys
Voice	Something you have	One-time codes via phone call
Recovery Code	Backup	One-time use recovery codes

Key Concepts

Concept	Description
`acr_values`	Request MFA during authentication
`amr` claim	Authentication Methods Reference - indicates how user authenticated
Step-up auth	Require MFA for specific actions after initial login
Adaptive MFA	Conditionally require MFA based on risk signals

Step 1: Enable MFA in Tenant

Via Auth0 Dashboard

Go to Security → Multi-factor Auth
Enable desired factors (TOTP, SMS, etc.)
Configure Policies:
- Always - Require MFA for all logins
- Adaptive - Risk-based MFA
- Never - Disable MFA (use step-up instead)

Via Auth0 CLI


# View current MFA configuration
auth0 api get "guardian/factors"

# Enable TOTP (One-time Password)
auth0 api put "guardian/factors/otp" --data '{"enabled": true}'

# Enable SMS
auth0 api put "guardian/factors/sms" --data '{"enabled": true}'

# Enable Push notifications
auth0 api put "guardian/factors/push-notification" --data '{"enabled": true}'

# Enable WebAuthn (Roaming - Security Keys)
auth0 api put "guardian/factors/webauthn-roaming" --data '{"enabled": true}'

# Enable WebAuthn (Platform - Biometrics)
auth0 api put "guardian/factors/webauthn-platform" --data '{"enabled": true}'

# Enable Email
auth0 api put "guardian/factors/email" --data '{"enabled": true}'

Step 2: Implement Step-Up Authentication

Step-up auth requires MFA for sensitive operations without requiring it for every login.

The `acr_values` Parameter

Request MFA by including acr_values in your authorization request:


acr_values=http://schemas.openid.net/pape/policies/2007/06/multi-factor

Implementation Pattern

The general pattern for all frameworks:

Check if user has already completed MFA (inspect amr claim)
If not, request MFA via acr_values parameter
Proceed with sensitive action once MFA is verified

For complete framework-specific examples, see Examples Guide:

React (basic and custom hook)
Next.js (App Router)
Vue.js
Angular

Additional Resources

This skill is split into multiple files for better organization:

Step-Up Examples

Complete code examples for all frameworks:

React (basic and custom hook patterns)
Next.js (App Router with API routes)
Vue.js (composition API)
Angular (services and components)

Backend Validation

Learn how to validate MFA status on your backend:

Node.js / Express JWT validation
Python / Flask validation
Middleware examples

Advanced Topics

Advanced MFA implementation patterns:

Adaptive MFA with Auth0 Actions
Conditional MFA based on risk signals
MFA Enrollment API

Reference Guide

Common patterns and troubleshooting:

Remember MFA for 30 days
MFA for high-value transactions
MFA status display
Error handling
AMR claim values
Testing strategies
Security considerations

auth0-quickstart - Basic Auth0 setup
auth0-passkeys - WebAuthn/passkey implementation
auth0-actions - Custom authentication logic

References

Install

Install with chainctl


chainctl skill install public/auth0/auth0-mfa:latest

Get started with chainctl

View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/auth0/agent-skills

Upstream commitce813504a5f05f2c09fe9aa3a10ca6a0b574d875

OCI reference

skills.cgr.dev/public/github.com/auth0/plugins/auth0/skills/auth0-mfa:latest

License

Apache-2.0

Files

HARDENING.md

LICENSE

SKILL.md

references/advanced.md

references/api.md

references/backend.md

references/examples.md

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.