Using Actions - MFA Authentication Method is Missing on First Login

When using Actions to trigger Multi-Factor Authentication (MFA) via:

api.multifactor.enable("any", { allowRememberBrowser: false });

On a first login, the MFA property returned by event.authentication.methods is not available, for example, the below may be returned in this case despite having completed MFA on the login flow:

[ { name: 'pwd', timestamp: '2025-12-11T14:34:38.188Z' } ]

If the user has an active session on the server then the property is returned as expected after having completed MFA:

[ { name: 'pwd', timestamp: '2025-12-11T14:34:38.188Z' }, { name: 'mfa', timestamp: '2025-12-11T14:34:54.444Z', type: 'otp' } ]

• Actions
• Multi-Factor Authentication (MFA)

api.multifactor.enable() triggers MFA after the Post-Login Actions flow is completed; as a result, the MFA authentication method is not returned. In a nutshell, when the Post Login Action is executed on the first login, MFA has not yet occurred; therefore, the property is not available.

To receive the MFA authenticator within an Action via event.authentication.methods every time the user completes MFA, regardless of whether a session exists on the server, the newer method of triggering MFA must be used for example:

api.authentication.challengeWith();
OR
api.authentication.challengeWithAny();