MfaWeb class

An interface for completing Multi-Factor Authentication (MFA) flows on the web using an mfa_token, as part of Auth0's flexible/expanded grant support.

When a token request fails because MFA is required, the resulting WebException has code == 'MFA_REQUIRED' and carries the mfa_token in its details map under the mfaToken key. Pass that token to Auth0Web.mfa(mfaToken:) to obtain an instance of this class and drive the challenge or enrollment flow.

This mirrors the mobile MfaApi, but is backed by the auth0-spa-js programmatic MFA API (Auth0Client.mfa), which requires auth0-spa-js v2.21.0 or later. Because the MFA context is stored on the same Auth0Client that produced the mfa_required error, you must call these methods on the same Auth0Web instance that triggered MFA.

It is not intended for you to instantiate this class yourself; an instance is available via Auth0Web.mfa(mfaToken:).

Usage example

final auth0 = Auth0Web('DOMAIN', 'CLIENT_ID');

try {
  await auth0.credentials();
} on WebException catch (e) {
  final mfaToken = e.details['mfaToken'] as String?;
  if (e.code == 'MFA_REQUIRED' && mfaToken != null) {
    final mfa = auth0.mfa(mfaToken: mfaToken);

    final authenticators = await mfa.getAuthenticators();
    final challenge = await mfa.challenge(
      authenticatorId: authenticators.first.id,
    );

    // For OTP factors, collect the code from the user, then:
    final credentials = await mfa.verifyOtp(otp: '123456');
  }
}

Constructors

MfaWeb(String _mfaToken)

Properties

hashCode → int: The hash code for this object.
no setterinherited
runtimeType → Type: A representation of the runtime type of the object.
no setterinherited

Methods

challenge({required String authenticatorId}) → Future<MfaChallenge>: Initiates a challenge for the authenticator identified by authenticatorId (obtained from getAuthenticators).
enrollEmail({required String email}) → Future<MfaEnrollmentChallenge>: Enrolls a new email factor for the given email address.
enrollPhone({required String phoneNumber, PhoneType type = PhoneType.sms}) → Future<MfaEnrollmentChallenge>: Enrolls a new phone (SMS or Voice) factor for the given phoneNumber.
enrollPush() → Future<MfaEnrollmentChallenge>: Enrolls a new push notification factor (Auth0 Guardian).
enrollTotp() → Future<MfaEnrollmentChallenge>: Enrolls a new TOTP (authenticator app) factor.
getAuthenticators() → Future<List<MfaAuthenticator>>: Lists the authenticators that can be used with the current mfa_token.
noSuchMethod(Invocation invocation) → dynamic: Invoked when a nonexistent method or property is accessed.
inherited
toString() → String: A string representation of this object.
inherited
verifyOob({required String oobCode, String? bindingCode, Set<String> scopes = const {'openid', 'profile', 'email'}, String? audience}) → Future<Credentials>: Verifies an out-of-band challenge (SMS, Email, Push) and exchanges the mfa_token for Credentials.
verifyOtp({required String otp, Set<String> scopes = const {'openid', 'profile', 'email'}, String? audience}) → Future<Credentials>: Verifies a one-time password (otp) for a TOTP authenticator and exchanges the mfa_token for Credentials.
verifyRecoveryCode({required String recoveryCode, Set<String> scopes = const {'openid', 'profile', 'email'}, String? audience}) → Future<Credentials>: Verifies a recoveryCode and exchanges the mfa_token for Credentials.

Operators

operator ==(Object other) → bool: The equality operator.
inherited