MFA Configured State

Checks whether the user has already configured MFA. If configured, displays the available methods for the user to select. If not configured, route to Configure MFA node. Requires Session Token to be enabled on the Auth node.

MFA Node

Node Card

MFA Configured State

true

false

Error edges

4090 · 4091

Category: MFA Nodes

Type: mfaConfiguredState

Typical position: After the Auth node (with Session Token enabled), before method-specific Verify nodes.

---

Properties

Property	Type	Default	Description
MFA Methods	multiselect	NA	Select the MFA methods to expose: Authenticator, Security Question, Email OTP, SMS OTP, Push Notification, Duo Authentication, Passkey.
Authenticator Button Text	text	NA	Button label for the Authenticator option. Shown when Authenticator is selected in MFA Methods. Required when enabled.
Security Question Button Text	text	NA	Button label for the Security Question option. Shown when Security Question is selected. Required when enabled.
Email OTP Button Text	text	NA	Button label for the Email OTP option. Shown when Email OTP is selected. Required when enabled.
SMS OTP Button Text	text	NA	Button label for the SMS OTP option. Shown when SMS OTP is selected. Required when enabled.
Backup Code Button Text	text	NA	Button label for the Backup Code option. Optional.
Duo Authentication Button Text	text	NA	Button label for the Duo Authentication option. Shown when Duo Authentication is selected. Required when enabled.
Push Notification Button Text	text	NA	Button label for the Push Notification option. Shown when Push Notification is selected. Required when enabled.
Passkey Button Text	text	NA	Button label for the Passkey option. Shown when Passkey is selected. Required when enabled.
Error Handling	custommultiselect	All errors set to automatic	Override the default message shown to users for each error code. Activates that error as a named output edge on the canvas.

Outputs & Errors

Output / Code	Condition	Default message
Email OTP	User selects Email OTP as the MFA method	NA
SMS OTP	User selects SMS OTP as the MFA method	NA
Authenticator	User selects Authenticator as the MFA method	NA
Security Question	User selects Security Question as the MFA method	NA
Duo Auth	User selects Duo Authentication as the MFA method	NA
Push Auth	User selects Push Notification as the MFA method	NA
Passkey	User selects Passkey as the MFA method	NA
Backup Code	User selects Backup Code as the recovery method	NA
false	MFA check failed or unhandled error	NA
4090	MFA not configured for user	MFA not configured
4091	No authenticator configured	Authenticator not configured

---

Common Next Nodes

MFA Configured State (Email OTP)→Send Email → Verify OTPemail OTP challenge path

MFA Configured State (SMS OTP)→Send SMS → Verify OTPSMS OTP challenge path

MFA Configured State (Authenticator)→Verify AuthenticatorTOTP challenge path

MFA Configured State (false)→Configure MFAno MFA configured: route to enrollment

When to Use / When Not To

Using MFA Configured State without Configure MFA

MFA Configured State must always be paired with Configure MFA on its 4090 output (user has no MFA configured). Without it, users who have not registered any second factor hit a dead end. Set MFA Flow = Mandatory on Configure MFA so setup cannot be skipped. If 4090 is not explicitly selected in Error Handling, it falls through to the false output: either way, route it to Configure MFA.

MFA Configured State (4090) → unconnected

MFA Configured State (4090) → Configure MFA (MFA Flow = Mandatory)

Auth without Session Token enabled

This node reads the session token issued by the Auth node to look up the user's registered MFA methods. If Session Token is disabled on the Auth node, this node has nothing to read and will fail.

Auth (Session Token: off) → MFA Configured State

Auth (Session Token: on) → MFA Configured State

Wire every method output to its verification path

Each method output must connect to its corresponding send + verify sequence. Unwired method outputs mean users who have that method registered are silently dropped.

Email OTP→ Send Email → Verify OTP Web Page → Verify Email/SMS OTP

SMS OTP→ Web Page (Phone) → Send SMS → Verify OTP Web Page → Verify Email/SMS OTP

Authenticator→ Verify OTP Web Page → Verify Authenticator

Backup Code→ Web Page (Backup Code Input) → Verify Backup Code