Multiple SMS Authentication Factors and Changing SMS
Last Updated:
Overview
We only have phone number as an MFA option (with either voice or text message).
Would we need to reset a user's existing MFA number before they're allowed to enroll another one?
What would be the endpoints that we'd need to call, in order, after obtaining the MFA token?
Applies To
- MFA API
Solution
When using the MFA API, the procedure could be:
- User logs into their account, requesting the MFA API audience and scopes for enroll, read:authenticators and remove:authenticators.
- User completes MFA using their existing enrolled authenticator (e.g. old phone number, or via recovery code).
- With the MFA Access token available, and using the list authenticators endpoint, the existing SMS authenticator's ID can be found here.
- Existing Authenticator is deleted using this endpoint.
- Enrollment can now be carried out for a new SMS authenticator.
