/challenge

Request

Initiates the challenge of subsequent factor(s) in a direct authentication flow after the token endpoint has responded with mfa_required. This endpoint is optional if the client is able to proceed without it, for example, the client knows it needs to follow up with an OTP and can prompt the end user for one.

Note: The /challenge endpoint requires client authentication. The method is configured per client app. See Client authentication methods.

Path

authorizationServerIdstringrequired

id of the authorization server

Bodyapplication/x-www-form-urlencoded

challenge_types_supportedstring

Space-separated list of direct authentication challenge types supported by the client

channel_hintstring(Channel)

The out-of-band channel for use with authentication. Required for all /primary-authenticate and /challenge requests with an out-of-band authenticator.

Enum:"push""sms""voice"

mfa_tokenstringrequired

The value returned from a previous token or challenge request for identifying the multifactor transaction across multiple requests

POST

/oauth2/{authorizationServerId}/v1/challenge

curl -i -X POST \
  'https://okta-subdomain.pixtulate.com/oauth2/{authorizationServerId}/v1/challenge' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d mfa_token=Qwk9va6QYgR3s7JMiWUm \
  -d channel_hint=push \
  -d challenge_types_supported=http://auth0.com/oauth/grant-type/mfa-oob

Responses

The next factor type to challenge is returned and in the case of out-of-band factors, any information needed for the out-of-band transaction.

Bodyapplication/json

binding_codestring

The end-user verification code used to bind the authorization operation on the secondary channel with the primary channel. Present only if binding_method=transfer.

binding_methodstring(BindingMethod)

The method used to bind the out-of-band channel with the primary channel.

Enum:"none""prompt""transfer"

challenge_typestring

The challenge type used for authentication

channelstring(Channel)

The out-of-band channel for use with authentication. Required for all /primary-authenticate and /challenge requests with an out-of-band authenticator.

Enum:"push""sms""voice"

expires_ininteger

Number of seconds until the oob_code expires

intervalinteger

The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint

oob_codestring

A unique identifier for identifying the out-of-band transaction across multiple requests

Response

{
  "challenge_type": "http://auth0.com/oauth/grant-type/mfa-otp"
}