MfaApiClient

try {
  await auth0.getTokenSilently({ authorizationParams: { audience: 'https://api.example.com' } });
} catch (e) {
  if (e instanceof MfaRequiredError) {
    // SDK automatically stores context for this mfaToken
    const authenticators = await auth0.mfa.getAuthenticators({ mfaToken: e.mfa_token });
    // ... complete MFA flow
  }
}

challenge(params: ChallengeAuthenticatorParams): Promise<ChallengeResponse>

const challenge = await mfa.challenge({
  mfaToken: mfaTokenFromLogin,
  challengeType: 'otp',
  authenticatorId: 'otp|dev_xxx'
});
// User enters OTP from their authenticator app

enroll(params: EnrollParams): Promise<EnrollmentResponse>

const enrollment = await mfa.enroll({
  mfaToken: mfaToken,
  factorType: 'otp'
});
console.log(enrollment.secret); // Base32 secret
console.log(enrollment.barcodeUri); // QR code URI

getAuthenticators(mfaToken: string): Promise<Authenticator[]>

try {
  await auth0.getTokenSilently();
} catch (e) {
  if (e instanceof MfaRequiredError) {
    // SDK automatically uses challenge types from error context
    const authenticators = await auth0.mfa.getAuthenticators(e.mfa_token);
  }
}

getEnrollmentFactors(mfaToken: string): Promise<EnrollmentFactor[]>

try {
  await auth0.getTokenSilently();
} catch (error) {
  if (error.error === 'mfa_required') {
    // Get enrollment options from SDK
    const enrollOptions = await auth0.mfa.getEnrollmentFactors(error.mfa_token);
    // [{ type: 'otp' }, { type: 'phone' }, { type: 'push-notification' }]

    showEnrollmentOptions(enrollOptions);
  }
}

verify(params: VerifyParams): Promise<TokenEndpointResponse>

const tokens = await mfa.verify({
  mfaToken: mfaTokenFromLogin,
  otp: '123456'
});
console.log(tokens.access_token);