Auth0 MFA

Use when adding MFA, 2FA, TOTP, SMS codes, push notifications, passkeys, or when requiring step-up verification for sensitive operations or meeting complianc...

Security Scan

The skill appears to do what it says (manage Auth0 MFA) and uses the Auth0 CLI, but the runtime instructions expect tenant management credentials and environment variables that the skill does not declare — this mismatch and the fact it runs commands that change your Auth0 tenant are worth caution.

Purpose & Capability

Name/description match the contents: all examples and CLI commands are about enabling/configuring Auth0 MFA, step-up auth, and related backend validation. Requiring the Auth0 CLI (auth0) is coherent with those tasks.

Instruction Scope

Instructions tell the agent to run auth0 CLI API calls (put/patch) and to deploy Actions — these are legitimate for configuring MFA but are tenant-changing operations. Examples and backend snippets reference environment variables (AUTH0_DOMAIN, AUTH0_AUDIENCE) and a management bearer token (MGMT_TOKEN). The skill does not explicitly warn that commands will modify tenant configuration or require management credentials; reviewers should expect these commands to perform live changes if run.

Install Mechanism

Install uses a Homebrew formula (auth0/auth0-cli/auth0), a reasonable and traceable distribution method for the official Auth0 CLI. No arbitrary download URLs or archive extraction are used.

Credentials

Registry metadata lists no required env vars, but SKILL.md and reference files assume several sensitive environment values and tokens (e.g., AUTH0_DOMAIN, AUTH0_AUDIENCE, MGMT_TOKEN). The skill will require management credentials to perform enable/patch/delete operations shown in examples; the absence of declared required credentials is an inconsistency and a potential gotcha for users.

Persistence & Privilege

Skill is not always-enabled, does not request persistent system-wide changes during install, and is instruction-only (no bundled code run at install). It will only act when invoked and then only via the auth0 CLI, so persistence/privilege level is limited to what the CLI + provided credentials allow.

What to consider before installing

This skill documents how to change Auth0 MFA settings and uses the Auth0 CLI; installing it will add the auth0 binary via Homebrew and the instructions will perform tenant-changing operations if run. Before installing or invoking: 1) Do not provide management tokens or tenant credentials to an untrusted agent — the examples require a management bearer token (MGMT_TOKEN) and tenant environment variables (AUTH0_DOMAIN, AUTH0_AUDIENCE). 2) Prefer least-privilege credentials (scoped management token) for testing, and review each CLI/API command before execution. 3) If you only need read-only guidance, you can use the README content without supplying credentials. 4) If you want the skill to be allowed to run changes automatically, ensure you understand and trust the agent and consider limiting its permissions and auditing runs.

Auth0 MFA Guide

Add Multi-Factor Authentication to protect user accounts and require additional verification for sensitive operations.

---

Overview

What is MFA?

Multi-Factor Authentication (MFA) requires users to provide two or more verification factors to access their accounts. Auth0 supports multiple MFA factors and enables step-up authentication for sensitive operations.

When to Use This Skill

• Adding MFA to protect user accounts
• Requiring additional verification for sensitive actions (payments, settings changes)
• Implementing adaptive/risk-based authentication
• Meeting compliance requirements (PCI-DSS, SOC2, HIPAA)

MFA Factors Supported

Factor	Type	Description
TOTP	Something you have	Time-based one-time passwords (Google Authenticator, Authy)
SMS	Something you have	One-time codes via text message
Email	Something you have	One-time codes via email
Push	Something you have	Push notifications via Auth0 Guardian app
WebAuthn	Something you have/are	Security keys, biometrics, passkeys
Voice	Something you have	One-time codes via phone call
Recovery Code	Backup	One-time use recovery codes

Key Concepts

Concept	Description
acr_values	Request MFA during authentication
amr claim	Authentication Methods Reference - indicates how user authenticated
Step-up auth	Require MFA for specific actions after initial login
Adaptive MFA	Conditionally require MFA based on risk signals

---

Step 1: Enable MFA in Tenant

Via Auth0 Dashboard

1. Go to Security → Multi-factor Auth
2. Enable desired factors (TOTP, SMS, etc.)
3. Configure Policies:
   • Always - Require MFA for all logins
   • Adaptive - Risk-based MFA
   • Never - Disable MFA (use step-up instead)

Via Auth0 CLI

# View current MFA configuration
auth0 api get "guardian/factors"

# Enable TOTP (One-time Password)
auth0 api put "guardian/factors/otp" --data '{"enabled": true}'

# Enable SMS
auth0 api put "guardian/factors/sms" --data '{"enabled": true}'

# Enable Push notifications
auth0 api put "guardian/factors/push-notification" --data '{"enabled": true}'

# Enable WebAuthn (Roaming - Security Keys)
auth0 api put "guardian/factors/webauthn-roaming" --data '{"enabled": true}'

# Enable WebAuthn (Platform - Biometrics)
auth0 api put "guardian/factors/webauthn-platform" --data '{"enabled": true}'

# Enable Email
auth0 api put "guardian/factors/email" --data '{"enabled": true}'

Configure MFA Policy

# Set MFA policy: "all-applications" or "confidence-score"
auth0 api patch "guardian/policies" --data '["all-applications"]'

---

Step 2: Implement Step-Up Authentication

Step-up auth requires MFA for sensitive operations without requiring it for every login.

The acr_values Parameter

Request MFA by including acr_values in your authorization request:

acr_values=http://schemas.openid.net/pape/policies/2007/06/multi-factor

Implementation Pattern

The general pattern for all frameworks:

1. Check if user has already completed MFA (inspect amr claim)
2. If not, request MFA via acr_values parameter
3. Proceed with sensitive action once MFA is verified

For complete framework-specific examples, see Examples Guide:

• React (basic and custom hook)
• Next.js (App Router)
• Vue.js
• Angular

---

Additional Resources

This skill is split into multiple files for better organization:

Step-Up Examples

Complete code examples for all frameworks:

• React (basic and custom hook patterns)
• Next.js (App Router with API routes)
• Vue.js (composition API)
• Angular (services and components)

Backend Validation

Learn how to validate MFA status on your backend:

• Node.js / Express JWT validation
• Python / Flask validation
• Middleware examples

Advanced Topics

Advanced MFA implementation patterns:

• Adaptive MFA with Auth0 Actions
• Conditional MFA based on risk signals
• MFA Enrollment API

Reference Guide

Common patterns and troubleshooting:

• Remember MFA for 30 days
• MFA for high-value transactions
• MFA status display
• Error handling
• AMR claim values
• Testing strategies
• Security considerations

---

Related Skills

• auth0-quickstart - Basic Auth0 setup
• auth0-passkeys - WebAuthn/passkey implementation
• auth0-actions - Custom authentication logic

---

References

• Auth0 MFA Documentation
• Step-Up Authentication
• MFA API
• acr_values Parameter