Implementing MFA Authentication with Descope Backend SDKs
Install SDK
npm i --save @descope/node-sdkImport and initialize Management SDK
import DescopeClient from '@descope/node-sdk';
const managementKey = "xxxx"
try{
// baseUrl="<URL>" // When initializing the Descope clientyou can also configure the baseUrl ex: https://auth.company.com - this is useful when you utilize a custom domain within your Descope project.
const descopeClient = DescopeClient({ projectId: '__ProjectID__', managementKey: managementKey });
} catch (error) {
// handle the error
console.log("failed to initialize: " + error)
}
Sign-Up, Sign-in, or Sign-Up-Or-In
The next step after adding the Descope backend SDK within your application is to utilize one of the Sign-Up, Sign-in, or Sign-Up-Or-In functions for the supported authentication methods. Once you have successfully received a JWT from the authentication method, you should store it for the next step in the MFA process.
MFA the user's authentication
Now that you have a valid JWT for your authenticated user, you can utilize Sign-in or Sign-Up-Or-In for one of the supported
authentication methods, adding the user Login Options. This example will focus on the mfa parameter
of the Login Options; however, for further details on Login Options, navigate here.
The below example implements MFA authentication via OTP Sign-In after the user successfully signed up via TOTP Sign-Up. After a successful MFA sign-in, you will need to process the verification code via OTP Verify. After verifying, the user will then have MFA authentication.
// Args:
// deliveryMethod: Delivery method to use to send OTP. Supported values include "email", "voice, or "sms"
const deliveryMethod = "email"
// loginId: email or phone - email or phone - the loginId for the user
const loginId = "email@company.com"
// loginOptions: login options for MFA, stepup, or custom claims. Ex: {stepup: true, mfa: false, customClaims: {}}
const loginOptions = {mfa: true}
// token: refresh token from the successful sign-in of the user
const token = "xxxx"
var resp = await descopeClient.otp.signIn[delivery_method](loginId, loginOptions, token);
if (!resp.ok) {
console.log("Failed to initialize mfa flow")
console.log("Status Code: " + resp.code)
console.log("Error Code: " + resp.error.errorCode)
console.log("Error Description: " + resp.error.errorDescription)
console.log("Error Message: " + resp.error.errorMessage)
}
else {
console.log("Successfully initialized mfa flow")
console.log(resp.data)
}