MFA Operations
getUserDevices
Fetch all MFA devices for the authenticated user.
Returns: Array of MfaDevice objects
Example:
addDevice
Add a new TOTP device for the user.
Parameters:
type - Device type (e.g., "totp")
Returns: MfaAddDevice containing the secret for authenticator setup
Example:
verifyDevice
Verify a newly added device with a TOTP code.
Parameters:
code - The 6-digit TOTP code from the authenticator app
type - Device type (e.g., "totp")
Example:
authenticateDevice
Authenticate an MFA device with a TOTP code.
Parameters:
params - Authentication parameters including code, device ID, and token options
Returns: MFA authentication token (optional)
Example:
deleteUserDevice
Delete an MFA device from the user’s account.
Parameters:
deviceId - ID of the device to delete
mfaAuthToken - MFA authentication token
Example:
getRecoveryCodes
Retrieve backup recovery codes for the user.
Parameters:
generateNewCodes - Whether to generate new codes or retrieve existing ones
Returns: Array of recovery code strings
Example:
getNewRecoveryCodes
Generate new recovery codes, invalidating old ones.
Returns: Array of new recovery code strings
Example:
isPendingRecoveryCodesAcknowledgment
Check if recovery codes need acknowledgment.
Returns: Boolean indicating if acknowledgment is pending
Example:
completeAcknowledgement
Acknowledge that user has saved their recovery codes.
Example:
authenticateRecoveryCode
Authenticate using a recovery code.
Parameters:
code - Recovery code and token creation options
Returns: MFA authentication token (optional)
Example:
Passkey Operations
signIn
Sign in using an existing passkey.
Returns: SdkUser object for the authenticated user
Example:
registerPasskey
Register a new passkey for the authenticated user.
Returns: Registration result
Example:
getPasskeys
Fetch all passkeys registered for the user.
Returns: Array of UserPasskey objects
Example:
authenticatePasskeyMFA
Authenticate with a passkey for MFA.
Parameters:
createMfaToken - Token creation options
relatedOriginRpId - Optional Relying Party ID (RP ID) for authenticating from a related origin. The canonical form is a bare hostname such as my.example.com; a full origin like https://my.example.com is also accepted and resolves to the same RP ID. It must match the rpId the credential was registered under.
Returns: PasskeyMfaResponse containing JWT token
Example:
deletePasskey
Delete a passkey from the user’s account.
Parameters:
request - Delete request containing the passkey ID
Example:
Data Types
MfaDevice
Represents an MFA device.
MfaAddDevice
Result of adding a new MFA device.
MfaAuthenticateDevice
Parameters for device authentication.
MfaCreateToken
Token creation options for MFA.
MfaAuthenticateRecoveryCode
Parameters for recovery code authentication.
UserPasskey
Represents a user’s passkey.
DeletePasskeyRequest
Request to delete a passkey.
PasskeyMfaResponse
Response from passkey MFA authentication.
Error Handling
All MFA and passkey operations can throw errors. Handle them appropriately:
See Also
Last modified on July 17, 2026