Auth0 Multi-Resource Refresh Tokens Do Not Support MFA API Audience
Last Updated:
Overview
Auth0 multi-resource refresh tokens do not support using the Multi-Factor Authentication (MFA) API as an audience. To retrieve enrolled MFA factors, use the My Account API audience when requesting a new token. The MFA API (https://<auth0_domain>/mfa/) fails when used as the audience for multi-resource refresh tokens.
Applies To
- Auth0
- Multi-resource refresh tokens
- Multi-Factor Authentication (MFA) API
- My Account API
Cause
The multi-resource refresh tokens feature does not support using the MFA API (https://<auth0_domain>/mfa/) as its audience.
Solution
How are enrolled MFA factors retrieved using multi-resource refresh tokens?
Retrieve enrolled MFA factors by requesting a new token with the My Account API audience and calling the corresponding endpoints.
- Request a new token using the My Account API audience.
- Call the My Account API endpoints to retrieve the enrolled MFA factors, or perform other tasks.
