<commit_before>---
layout: post
title: "Introducing the Multi-Factor Authorization API"
description: "Embed Multi-Factor Authorization using push notifications, SMS, or TOTP anywhere, taking full control of the experience."
longdescription: "We have developed a new API to make use of Multi-Factor Authorization through an HTTP API, allowing developers to take full control of the experience. Push notifications, SMS, TOTP, and even multiple authenticators are supported. In this article we take a look at the API while developing a CLI application."
date: 2018-04-10 12:30
category: Announcements, Content
author:
  name: <NAME>
  url: https://twitter.com/speyrott?lang=en
  mail: <EMAIL>
  avatar: https://en.gravatar.com/userimage/92476393/001c9ddc5ceb9829b6aaf24f5d28502a.png?size=200
design:
  bg_color: "#222228"
  image: https://cdn.auth0.com/blog/guide-to-oauth2/logo.png
  image_size: "100%"
  image_bg_color: "#222228"
tags:
- oauth
- oauth2
- mfa
- rfc
- ietf
- network
- working
- group
- multi-factor
- authentication
- authorization
- otp
- totp
- push
- push-notifications
- guardian
- authenticator
- google-authenticator
- duo
related:
- 2018-02-07-oauth2-the-complete-guide
- 2017-10-19-oauth-2-best-practices-for-native-apps
- ten-things-you-should-know-about-tokens-and-cookies
---

We are pleased to announce the availability of our [Multi-Factor Authorization API](https://auth0.com/docs/api-auth/tutorials/multifactor-resource-owner-password). Up to now, we have provided support for MFA through a simple switch in the Auth0 Dashboard, following our premise of *simplicity* and ease of use. However, we also believe in providing powerful *building blocks* for our users. For this reason we have developed a new API to perform the full MFA flow, even with multiple authenticators, in a flexible and convenient way. In this article we will take a look at the API and build a simple CLI app to demonstrate how to use it. Read on!

{% include tweet_quote.html quote_text="The MFA API is now available, learn how to embed MFA in your apps taking full control of the experience!" %}

---

## Why?
Up to now, enabling MFA at Auth0 was simply a matter of flipping a switch and optionally selecting which application you wanted to enable MFA for. When MFA is enabled, hitting the `/authorize` endpoint or starting an authorization flow through one of our libraries was enough to trigger MFA. Simple, convenient.

![MFA Switch](https://cdn.auth0.com/blog/oauth2-mfa-api/1-mfa-enable.png)<commit_msg>Use authentication rather than authorization for consistency with product docs.<commit_after>---
layout: post
title: "Introducing the Multi-Factor Authentication API"
description: "Embed Multi-Factor Authentication using push notifications, SMS, or TOTP anywhere, taking full control of the experience."
longdescription: "We have developed a new API to make use of Multi-Factor Authentication through an HTTP API, allowing developers to take full control of the experience. Push notifications, SMS, TOTP, and even multiple authenticators are supported. In this article we take a look at the API while developing a CLI application."
date: 2018-04-10 12:30
category: Announcements, Content
author:
  name: <NAME>
  url: https://twitter.com/speyrott?lang=en
  mail: <EMAIL>
  avatar: https://en.gravatar.com/userimage/92476393/001c9ddc5ceb9829b6aaf24f5d28502a.png?size=200
design:
  bg_color: "#222228"
  image: https://cdn.auth0.com/blog/guide-to-oauth2/logo.png
  image_size: "100%"
  image_bg_color: "#222228"
tags:
- oauth
- oauth2
- mfa
- rfc
- ietf
- network
- working
- group
- multi-factor
- authentication
- authorization
- otp
- totp
- push
- push-notifications
- guardian
- authenticator
- google-authenticator
- duo
related:
- 2018-02-07-oauth2-the-complete-guide
- 2017-10-19-oauth-2-best-practices-for-native-apps
- ten-things-you-should-know-about-tokens-and-cookies
---

We are pleased to announce the availability of our [Multi-Factor Authentication API](https://auth0.com/docs/api-auth/tutorials/multifactor-resource-owner-password). Up to now, we have provided support for MFA through a simple switch in the Auth0 Dashboard, following our premise of *simplicity* and ease of use. However, we also believe in providing powerful *building blocks* for our users. For this reason we have developed a new API to perform the full MFA flow, even with multiple authenticators, in a flexible and convenient way. In this article we will take a look at the API and build a simple CLI app to demonstrate how to use it. Read on!

{% include tweet_quote.html quote_text="The MFA API is now available, learn how to embed MFA in your apps taking full control of the experience!" %}

---

## Why?
Up to now, enabling MFA at Auth0 was simply a matter of flipping a switch and optionally selecting which application you wanted to enable MFA for. When MFA is enabled, hitting the `/authorize` endpoint or starting an authorization flow through one of our libraries was enough to trigger MFA. Simple, convenient.

![MFA Switch](https://cdn.auth0.com/blog/oauth2-mfa-api/1-mfa-enable.png)
{'fraction_non_alphanumeric': 0.08500196309383588, 'fraction_numerical': 0.0325873576756969, 'mean_word_length': 4.35751840168244, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 10, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3515046', 'n_tokens_mistral': 1624, 'n_tokens_neox': 1478, 'n_words': 610}