Resource Owner Password Flow with MFA: Missing api_token in API Response

This article addresses an issue where the api_token parameter is missing from the API response during the Resource Owner Password flow, even when Multi-Factor Authentication (MFA) is required. To complete MFA, the client must use the api_token from the Authentication API response.

Example:

{

"error": "mfa_required",

"error_description": "Multifactor authentication required",

"mfa_token": "Fe26...Ha"

}

• ROPG
• Resource Owner Password Flow
• MFA

The api_token is not returned when Multi-Factor Authentication (MFA) is triggered using the challengeWith(Any) or enrollWith(Any) methods in Actions.

The mfa_token is returned when the api.multifactor.enable method is used.

For more details on this flow, see Authenticate Using ROPG Flow with MFA.