# MFA (multi-factor authentication)

The table below provides a comprehensive overview of the Flashback API multi-factor authentication endpoints, grouped by functional area. Each section lists the available HTTP functions along with a concise description of their purpose, helping developers understand how to implement secure multi-factor authentication.

{% hint style="info" %}
Multi-factor authentication enhances security by requiring users to provide additional verification beyond their password. The Flashback platform supports multiple MFA methods including Google Authenticator, Magic Links, and WebAuthn Passkeys.
{% endhint %}

## MFA Status & Methods API Calls

<table><thead><tr><th width="247.4000244140625">Method</th><th>API Reference</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:green;"><code>GET</code></mark><code>/mfa/status</code></td><td><a href="/pages/7huB9qhrOHa5rTkzhOv5"><strong>get__mfa_status</strong></a></td><td>Get the current MFA status for the authenticated user.</td></tr><tr><td><mark style="color:green;"><code>GET</code></mark><code>/mfa/methods</code></td><td><a href="/pages/MSGpLKFmMcRKSy4lv2mi"><strong>get__mfa_methods</strong></a></td><td>Get available MFA methods and their configuration status.</td></tr></tbody></table>

## MFA Setup & Configuration API Calls

<table><thead><tr><th width="247.4000244140625">Method</th><th>API Reference</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:orange;"><code>POST</code></mark><code>/mfa/setup</code></td><td><a href="/pages/LtgxzybCNAPJSIUTpitT"><strong>post_mfa_setup</strong></a></td><td>Initialize setup for an MFA method.</td></tr><tr><td><mark style="color:orange;"><code>POST</code></mark><code>/mfa/verify-setup</code></td><td><a href="/pages/w9LRGcv3pVy7NaZ3iLMi"><strong>post__mfa_verify-setup</strong></a></td><td>Verify and complete MFA setup process.</td></tr><tr><td><mark style="color:orange;"><code>POST</code></mark><code>/mfa/enable</code></td><td><a href="/pages/ktJp8dKpC9YC2LMO6v1T"><strong>post__mfa_enable</strong></a></td><td>Enable a configured MFA method.</td></tr><tr><td><mark style="color:orange;"><code>POST</code></mark><code>/mfa/disable</code></td><td><a href="/pages/pOWQFOHsws9cRYwDFkz3"><strong>post_mfa_disable</strong></a></td><td>Disable an enabled MFA method.</td></tr></tbody></table>

## MFA Management API Calls

<table><thead><tr><th width="247.4000244140625">Method</th><th>API Reference</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:orange;"><code>POST</code></mark><code>/mfa/primary</code></td><td><a href="/pages/r8cNuwqdot7MUJnkR0zM"><strong>post__mfa_primary</strong></a></td><td>Set the primary MFA method for the user.</td></tr><tr><td><mark style="color:orange;"><code>POST</code></mark><code>/mfa/reset</code></td><td><a href="/pages/JwFFImrXYF1Av3EgpN0u"><strong>post__mfa_reset</strong></a></td><td>Reset user's MFA configuration (self-service).</td></tr><tr><td><mark style="color:orange;"><code>POST</code></mark><code>/mfa/organization/enforce</code></td><td><a href="/pages/oV1F0iqXizMJiQH6At4y"><strong>post__mfa_organization_enforce</strong></a></td><td>Enforce MFA for organization members (admin only).</td></tr></tbody></table>

## Magic Link MFA API Calls

<table><thead><tr><th width="247.4000244140625">Method</th><th>API Reference</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:orange;"><code>POST</code></mark><code>/mfa/magic-link/send</code></td><td><a href="/pages/VLTiY40YLrMBqMJ4Mftc"><strong>post__mfa_magic-link_send</strong></a></td><td>Send magic link for MFA verification.</td></tr><tr><td><mark style="color:orange;"><code>POST</code></mark><code>/mfa/magic-link/activate</code></td><td><a href="/pages/L1ZeJIpFgm2TL195mCs4"><strong>post__mfa_magic-link_activate</strong></a></td><td>Activate magic link MFA during setup.</td></tr></tbody></table>

## Passkey MFA API Calls

<table><thead><tr><th width="247.4000244140625">Method</th><th>API Reference</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:orange;"><code>POST</code></mark><code>/mfa/passkey/auth-options</code></td><td><a href="/pages/CVZQcitcnMmfC6jueupJ"><strong>post__passkey_auth-options</strong></a></td><td>Generate authentication options for passkeys.</td></tr><tr><td><mark style="color:orange;"><code>POST</code></mark><code>/mfa/passkey/complete-registration</code></td><td><a href="/pages/3MFQTEJvaa9GcgUhN85Q"><strong>post__mfa_passkey_complete-registration</strong></a></td><td>Complete passkey registration process.</td></tr><tr><td><mark style="color:orange;"><code>POST</code></mark><code>/mfa/passkey/complete-registration-1</code></td><td><a href="/pages/aJ0XcGZjb0uazhfdCcmf"><strong>post__mfa_passkey_complete-registration-1</strong></a></td><td>Alternative passkey registration endpoint.</td></tr></tbody></table>

## MFA Authentication Flow

### 1. **Setup Phase**

* User initiates MFA setup with `/mfa/setup`
* System generates configuration data (QR codes, challenges, etc.)
* User completes verification with `/mfa/verify-setup`
* MFA method is enabled with `/mfa/enable`

### 2. **Authentication Phase**

* User provides primary credentials (username/password)
* System prompts for MFA verification
* User completes MFA challenge
* Full access is granted upon successful verification

### 3. **Management Phase**

* Users can manage their MFA methods
* Set primary MFA method
* Enable/disable specific methods
* Reset MFA configuration when needed

## Supported MFA Methods

* **Google Authenticator**: Time-based one-time passwords (TOTP)
* **Magic Links**: Secure email-based authentication
* **Passkeys**: WebAuthn-based biometric or hardware key authentication

{% hint style="warning" %}
**Security Note**: MFA significantly enhances account security. Always use HTTPS in production and ensure proper session management. Users should have backup MFA methods configured.
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.flashback.tech/support-reference/platform-api-reference/mfa-multi-factor-authentication.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.