---
title: Multi-Factor Authentication
description: Add email or SMS OTP, TOTP, or WebAuthn passkeys as MFA factors and require step-up authentication for sensitive actions.
sidebar:
  label: Overview
  order: 10
---

## MFA summary

- SuperTokens supports email or SMS OTP, TOTP, and WebAuthn or Passkeys as MFA factors.
- Require an additional challenge for sensitive routes or actions with step-up authentication.
- Magic links work only as a first factor with the prebuilt UI because the link may open on another device. Use email or SMS OTP as a later factor instead.
- MFA is available for managed SuperTokens deployments.

## Overview

Multi-factor authentication (MFA) is a security process that requires users to verify their identity through multiple forms of credentials before gaining access to a system.
**SuperTokens** allows you to integrate MFA in your application using Email/SMS One-Time Password (OTP), Time-based One-Time Password (TOTP), or WebAuthn/Passkeys.

## Prerequisites

<PaidFeatureCallout />

Magic link via email or SMS is only supported as a first factor for pre-built UI.
It will not work as a second factor because if the magic link is opened on a different device, there would be no reference to the existing session (which was created before first factor completion).
Instead, you can use OTP based authentication, using email or SMS.
It achieves the same level of security as a magic link.

## Getting started

The quickest way to get a glimpse of how MFA works with **SuperTokens** is to use the example app.
Run the following command to get started:

```bash
npx create-supertokens-app@latest --recipe=multifactorauth
```

Besides that, you can check the initial quickstart guide for step-by-step instructions, along with the other guides for more specific use cases.

Before you explore a guide, read through the **Important Concepts** page first.
It explains multiple topics that get used in each tutorial.

<CardGroup cols={3}>
  <Card title="Important Concepts" icon="book-open" href="/additional-verification/mfa/important-concepts">
Go through a quick explanation of how MFA works and some common terminologies.
</Card>
  <Card title="Quickstart Guide" icon="rocket" href="/additional-verification/mfa/initial-setup">
Implement an authentication flow that uses MFA.
</Card>
  <Card title="Implement Step Up Authentication" icon="arrow-up-right" href="/additional-verification/mfa/step-up-auth">
Require additional authentication challenges on specific routes or actions.
</Card>
  <Card title="Implement Recovery Codes" icon="key-round" href="/additional-verification/mfa/backup-codes">
Allow users to recover their account if they lose access to one of the factors.
</Card>
</CardGroup>

## Customization 

To adjust the functionality to fit your use case you can explore different sections from the documentation. 

<CardGroup cols={3}>
  <Card title="Require TOTP for all users" icon="shield-check" href="/additional-verification/mfa/totp/totp-for-all-users">
Force all users to use TOTP.
</Card>
  <Card title="Require TOTP for specific users" icon="users" href="/additional-verification/mfa/totp/totp-for-opt-in-users">
Enable TOTP only for some of the users.
</Card>
  <Card title="Require OTP for all users" icon="mail" href="/additional-verification/mfa/email-sms-otp/otp-for-all-users">
Force all users to use OTP.
</Card>
  <Card title="Require OTP for specific users" icon="users" href="/additional-verification/mfa/email-sms-otp/otp-for-opt-in-users">
Enable OTP only for some of the users.
</Card>
  <Card title="WebAuthn" icon="fingerprint" href="/additional-verification/mfa/webauthn-setup">
Use WebAuthn as a secondary factor
</Card>
  <Card title="Protect frontend and backend routes" icon="lock-keyhole" href="/additional-verification/mfa/protect-routes">
Check for the MFA status on specific routes.
</Card>
</CardGroup>