Multi-Factor Authentication

MFA in 3SO is a challenge layered on top of any login — password, passwordless OTP, or federated SSO — before an authorization code or token is issued. Six factor types are supported out of the box.

TOTP

Time-based one-time passwords compatible with any standard authenticator app — Google Authenticator, Authy, 1Password, etc.

HOTP

HMAC-based one-time passwords for hardware tokens and other counter-based authenticator use cases.

Email MFA

One-time codes delivered to a verified email address as a second factor, via the Resend email integration.

SMS / Phone MFA

Phone number verification and OTP delivery via Twilio for users who prefer SMS-based codes.

Push Notification MFA

Firebase-powered push challenges to a registered mobile device, with real-time approve/deny status and device-based challenge-response.

Recovery Codes

Single-use backup codes generated up front so users retain account access if their primary MFA channel is unavailable.

Where it fits in the OAuth flow

MFA is enforced during user authentication, before the authorization code is issued

1. Client redirects to /oauth2/authorize (Authorization Code flow)
2. User signs in with password or passwordless OTP
3. If MFA is enabled on the account, 3SO issues a challenge
   (TOTP / HOTP / email / SMS / push) and waits for approval
4. On success, 3SO redirects back with the authorization code
5. Client exchanges the code for tokens as usual