Implementing MFA

Actions are the foundation for implementing multi-factor authentication (MFA) and step-up authentication in your application. By tracking specific user activities as actions, you can apply contextual security policies that challenge users when needed.

​

MFA on login

The most common MFA scenario is requiring additional authentication after a user’s primary credentials (username and password) have been validated.

Here’s how the flow works with Authsignal:

​

Implementation

1. Track the login action after validating primary credentials:

const request = {
  userId: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
  action: "signIn",
  attributes: {
    redirectUrl: "https://yourapp.com/callback",
  },
};

const response = await authsignal.track(request);

const url = response.url;

2. Handle the response based on the action state:

   • If CHALLENGE_REQUIRED: Redirect user to the authentication flow
   • If ALLOW: Proceed with login
   • If BLOCK: Deny access
   • If REVIEW: Review the challenge

3. Follow the standard integration steps covered in actions getting started to launch the challenge URL and validate the result.

​

Step-up authentication

Step-up authentication challenges users when they perform sensitive operations, even if they’re already logged in. This is ideal for high-risk actions like financial transactions, account settings changes, or data exports.

​

Common step-up scenarios

• Financial transactions: Challenge for payments above a certain threshold
• Account changes: Require authentication for email/password changes
• Administrative actions: Challenge admin users for sensitive operations
• Data access: Authenticate before accessing sensitive information

​

Combining with rules for adaptive MFA

While actions define what to protect, rules define when to challenge users. You can create adaptive MFA flows by combining actions with rules:

• Challenge only on new devices
• Require stronger authentication for high-risk IP addresses
• Skip MFA for trusted locations
• Apply different requirements based on user risk scores

Learn more about implementing adaptive MFA with rules.