When using api.multifactor.enable, later actions do not register the Multifactor Authentication (MFA) timestamp in event.authentication.method, even after the user completes the MFA challenge.

• Actions
• Multifactor Authentication (MFA)

The api.multifactor.enable() call operates asynchronously to the rest of the action pipeline. The pipeline continues to execute while the user is challenged for MFA. With the exception of redirects, the Action pipeline could complete before the user finishes the MFA challenge.

Because Actions execute quickly, a later action that triggers will still read the event.authentication.methods object as having only the first factor. For example:

[ { name: 'pwd', timestamp: '2024-07-11T13:02:03.128Z' } ]

However, if the user is redirected back to /authorize (e.g., to get new tokens) with a valid Auth0 session, the session cookie is recognized. The Actions pipeline triggers again, but this time the event object contains the updated event.authentication.methods object, including the MFA timestamp. For example: 

[{ name: 'pwd', timestamp: '2024-07-11T13:02:03.128Z' },
{ name: 'mfa', timestamp: '2024-07-11T13:02:20.849Z', type: 'phone' }]

If it is required to know that the user completed MFA within the same Action pipeline execution, the recommended approach is to use the Customize MFA Selection feature.

• Unlike api.multifactor.enable(), the Action pipeline is interrupted when an api.authentication.challengeWithAny() or api.authentication.challengeWith() call is made.

• Subsequent Actions will not run until after the user completes the challenge.

• This ensures the event.authentication.methods object is updated with the new method timestamp before later Actions execute.

Related References

• Post-login Action API Reference 
• Customize MFA Selection for Universal Login
• Sequenced and contextual flows