次のような場合に使用: アプリに多要素認証（複数の確認方法による本人確認）やステップアップ認証（重要な操作の前に追加確認）を追加する場合。ユーザーがログイン時や機密性の高い操作の前に、2つ目の確認方法（TOTP・時間で変わるコード、SMS・短いメール、パスキー、プッシュ通知など）での本人確認を必要とする場合が該当します。 また、状況に応じた多要素認証（リスク判定に基づく柔軟な認証）や、HIPAA（医療情報保護規制）、PCI-DSS（クレジットカード業界の保護基準）といった規制上の要件がある場合も使用します。ユーザーが単に「二要素認証を追加してほしい」「この操作の前に多要素認証を必須にしてほしい」と言った場合でも該当します。
Use when adding MFA or step-up authentication to an app — requiring users to verify with a second factor (TOTP, SMS, passkey, push) for login or before a sensitive action. Also use for adaptive/risk-based MFA or compliance requirements like HIPAA or PCI-DSS, even if the user just says "add two-factor auth" or "require MFA before this action".
Add Multi-Factor Authentication to protect user accounts and require additional verification for sensitive operations.
Multi-Factor Authentication (MFA) requires users to provide two or more verification factors to access their accounts. Auth0 supports multiple MFA factors and enables step-up authentication for sensitive operations.
| Factor | Type | Description |
|---|---|---|
| TOTP | Something you have | Time-based one-time passwords (Google Authenticator, Authy) |
| SMS | Something you have | One-time codes via text message |
| Something you have | One-time codes via email | |
| Push | Something you have | Push notifications via Auth0 Guardian app |
| WebAuthn | Something you have/are | Security keys, biometrics, passkeys |
| Voice | Something you have | One-time codes via phone call |
| Recovery Code | Backup | One-time use recovery codes |
| Concept | Description |
|---|---|
acr_values |
Request MFA during authentication |
amr claim |
Authentication Methods Reference - indicates how user authenticated |
| Step-up auth | Require MFA for specific actions after initial login |
| Adaptive MFA | Conditionally require MFA based on risk signals |
# View current MFA configuration
auth0 api get "guardian/factors"
# Enable TOTP (One-time Password)
auth0 api put "guardian/factors/otp" --data '{"enabled": true}'
# Enable SMS
auth0 api put "guardian/factors/sms" --data '{"enabled": true}'
# Enable Push notifications
auth0 api put "guardian/factors/push-notification" --data '{"enabled": true}'
# Enable WebAuthn (Roaming - Security Keys)
auth0 api put "guardian/factors/webauthn-roaming" --data '{"enabled": true}'
# Enable WebAuthn (Platform - Biometrics)
auth0 api put "guardian/factors/webauthn-platform" --data '{"enabled": true}'
# Enable Email
auth0 api put "guardian/factors/email" --data '{"enabled": true}'
# Set MFA policy: "all-applications" or "confidence-score"
auth0 api patch "guardian/policies" --data '["all-applications"]'
Step-up auth requires MFA for sensitive operations without requiring it for every login.
acr_values ParameterRequest MFA by including acr_values in your authorization request:
acr_values=http://schemas.openid.net/pape/policies/2007/06/multi-factor
The general pattern for all frameworks:
amr claim)acr_values parameterFor complete framework-specific examples, see Examples Guide:
This skill is split into multiple files for better organization:
Complete code examples for all frameworks:
Learn how to validate MFA status on your backend:
Advanced MFA implementation patterns:
Common patterns and troubleshooting:
auth0-quickstart - Basic Auth0 setupauth0-passkeys - WebAuthn/passkey implementationauth0-actions - Custom authentication logic原文・著作権は Anthropic および各プラグイン作者に帰属します。日本語訳は Claude API による自動翻訳です。