Overview
Multi-factor authentication (MFA) adds a second verification step after the user’s primary authentication method. This strengthens account security by requiring something the user has (an authenticator app or passkey device) in addition to something they know or are (password, email, wallet signature, etc.).This page covers MFA for end users of your application. For MFA on the Dynamic Dashboard (admin login), see Dashboard MFA.
Methods (TOTP, Passkey)
TOTP (Time-based One-Time Password)
TOTP uses an authenticator app (e.g. Google Authenticator, Authy, 1Password) to generate a six-digit code that rotates every 30 seconds. The user registers their authenticator app during setup and enters the current code when prompted for MFA.Passkey
Passkey-based MFA uses WebAuthn to verify the user with a hardware security key, biometric (fingerprint, face), or platform authenticator. Unlike passkey as a primary sign-in method, passkey MFA is used as an additional verification step after the user has already authenticated.How MFA works in Dynamic
When MFA is enabled and required, Dynamic issues the initial JWT with arequiresAdditionalAuth scope after the primary authentication step. This signals that the user must complete an additional verification before the token is fully trusted.
- User completes primary authentication (email, wallet, social, etc.) and receives a JWT with the
requiresAdditionalAuthscope. - The SDK prompts the user to complete MFA (TOTP code or passkey verification).
- Upon successful MFA, Dynamic upgrades the JWT scope — removing
requiresAdditionalAuth— and the user is fully authenticated.
requiresAdditionalAuth scope when verifying JWTs and reject or limit access for tokens that still carry it. See Tokens for verification details.
MFA modes
Dynamic supports different MFA modes depending on when and how MFA is enforced:- Session-based MFA: Required at sign-in. The user must complete MFA every time they authenticate and establish a new session.
- Action-based MFA: Required before specific actions (e.g. high-value transactions). MFA is triggered on-demand rather than at login.