<!-- llms.txt: https://workos.com/llms.txt -->

# Authentication Factor

An object representing an Authentication Factor.

## Delete Factor

Permanently deletes an Authentication Factor. It cannot be undone.

:::code-group{title="Request"}

```bash language="curl"
curl --request DELETE \
  --url https://api.workos.com/auth/factors/auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ \
  --header "Authorization: Bearer sk_example_123456789"
```

```js language="js"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

await workos.mfa.deleteFactor('auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ');
```

```rb language="ruby"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.multi_factor_auth.delete_factor(id: "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ")
```

```py language="python"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.multi_factor_auth.delete_factor(id_="auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ")
```

```go language="go"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.MultiFactorAuth().DeleteFactor(context.Background(), "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ")
	if err != nil {
		panic(err)
	}
}
```

```php language="php"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->multiFactorAuth()
    ->deleteFactor(id: "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ");
```

```java language="java"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.multiFactorAuth.deleteFactor("auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ");
```

```cs language="dotnet"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.MultiFactorAuth.DeleteFactorAsync("auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ");
```

```rust language="rust"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .multi_factor_auth()
        .delete_factor("auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ")
        .await?;

    Ok(())
}
```

:::

## Enroll Factor

Enrolls an Authentication Factor to be used as an additional factor of authentication. The returned ID should be used to create an authentication Challenge.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request POST \
  --url "https://api.workos.com/auth/factors/enroll" \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "type": "totp",
        "totp_issuer": "Foo Corp",
        "totp_user": "alan.turing@example.com"
    }
BODY
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

const factor = await workos.mfa.enrollFactor({
  type: 'totp',
  issuer: 'Foo Corp',
  user: 'alan.turing@example.com',
});
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.multi_factor_auth.enroll_factor(type: "totp")
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.multi_factor_auth.enroll_factor(type="totp")
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.MultiFactorAuth().EnrollFactor(context.Background(), &workos.MultiFactorAuthEnrollFactorParams{
		Type: "totp",
	})
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos->multiFactorAuth()->enrollFactor(type: "totp");
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;
import com.workos.multifactorauth.MultiFactorAuthApi.EnrollFactorOptions;

WorkOS workos = new WorkOS("sk_example_123456789");

EnrollFactorOptions options = EnrollFactorOptions.builder().type("totp").build();

workos.multiFactorAuth.enrollFactor(options);
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.MultiFactorAuth.EnrollFactorAsync(new MultiFactorAuthEnrollFactorOptions {
    Type = "totp",
});
```

```rust language="rust" title="Request" tab="1"
use workos::Client;
use workos::multi_factor_auth::EnrollFactorParams;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .multi_factor_auth()
        .enroll_factor(
            EnrollFactorParams {
                type_: "totp".into(),
                ..Default::default()
            }
        )
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "authentication_factor",
  "id": "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ",
  "type": "totp",
  "user_id": "user_01E4ZCR3C56J083X43JQXF3JK5",
  "totp": {
    "issuer": "WorkOS",
    "user": "user@example.com",
    "secret": "JBSWY3DPEHPK3PXP",
    "qr_code": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUg...",
    "uri": "otpauth://totp/WorkOS:user@example.com?secret=JBSWY3DPEHPK3PXP&issuer=WorkOS"
  },
  "created_at": "2026-01-15T12:00:00.000Z",
  "updated_at": "2026-01-15T12:00:00.000Z"
}
```

:::

## Get Factor

Gets an Authentication Factor.

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/auth/factors/auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ" \
  --header "Authorization: Bearer sk_example_123456789"
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

const factor = await workos.mfa.getFactor(
  'auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ',
);
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.multi_factor_auth.get_factor(id: "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ")
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.multi_factor_auth.get_factor(id_="auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ")
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.MultiFactorAuth().GetFactor(context.Background(), "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ")
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->multiFactorAuth()
    ->getFactor(id: "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ");
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.multiFactorAuth.getFactor("auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ");
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.MultiFactorAuth.GetFactorAsync("auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ");
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .multi_factor_auth()
        .get_factor("auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ")
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "authentication_factor",
  "id": "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ",
  "type": "totp",
  "user_id": "user_01E4ZCR3C56J083X43JQXF3JK5",
  "totp": {
    "issuer": "WorkOS",
    "user": "user@example.com"
  },
  "created_at": "2026-01-15T12:00:00.000Z",
  "updated_at": "2026-01-15T12:00:00.000Z"
}
```

:::

### authentication_factor

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `object` | "authentication_factor" | Yes | Distinguishes the Authentication Factor object. |
| `id` | string | Yes | The unique ID of the Factor. |
| `type` | "generic_otp" \| "sms" \| "totp" \| "webauthn" | Yes | The type the Factor. Can be either `totp` or `sms`. |
| `user_id` | string | No | The ID of the [user](/reference/authkit/user). |
| `sms` | object | No | Additional information for `sms` Factors. |
| `totp` | object | No | Additional information for `totp` Factors. |
| `created_at` | string | Yes | The timestamp when the Factor was created. |
| `updated_at` | string | Yes | The timestamp when the Factor was last updated. |

### DELETE /auth/factors/{id}

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | Yes | The unique ID of the Factor. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `empty` | empty | Returns an empty response on success. |

### POST /auth/factors/enroll

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `type` | "generic_otp" \| "sms" \| "totp" | Yes | The type of factor you wish to enroll. `totp` `sms` |
| `phone_number` | string | No | A valid phone number for an SMS-enabled device. Required when type is `sms`. |
| `totp_issuer` | string | No | An identifier for the organization issuing the challenge. Should be the name of your application or company. Required when type is `totp`. |
| `totp_user` | string | No | An identifier for the user. Used by authenticator apps to label connections. Required when type is `totp`. |
| `user_id` | string | No | The ID of the user to associate the factor with. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `authentication_factor` | object | Distinguishes the authentication factor object. |

### GET /auth/factors/{id}

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | Yes | The unique ID of the Factor. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `authentication_factor` | object | Distinguishes the authentication factor object. |