MFA OTP Login

Email/password login with a second-factor OTP challenge. Checks whether the user has MFA configured on their profile, routes unconfigured users through MFA setup, then challenges via SMS OTP (new phone number collected) or Email OTP depending on the configured method.

MFA

How to import

In the Admin Console go to Workflows → New Workflow → From Template, select MFA OTP Login, and click Import.

Identity Lookup is required for all MFA flows

MFA nodes depend on a resolved identity in the session. Identity Lookup must run before MFA Configured State: without it the MFA state check has no profile to read and will fail. Do not replace Identity Lookup with Auth alone.

Node Topology

How the Flow Works

Entry: every request hits Login Web Page (Email + Password).
Identity Lookup: resolves the profile without authenticating. Required so MFA Configured State can read registered methods. False (user not found) loops back to Login Web Page.
MFA Configured State: reads registered second factors and routes by method:
- Email OTP → Send Email → Verify OTP Web Page → Verify Email/SMS OTP
- SMS OTP → Web Page (Phone) → Send SMS → Verify OTP Web Page → Verify Email/SMS OTP
- Failure (no MFA registered) → Configure MFA (mandatory setup) → SMS OTP path
Verify Email/SMS OTP: validates the submitted code. True → Success Final. False → Failure Final.
Update MFA Phone: wired after Verify Email/SMS OTP True on the SMS path. Saves the phone number only after the user proves ownership via OTP.

Nodes Used & Why

Node	Category	Why it's here	Typical next node
Login (Web Page)	Input	Collects email and password	Identity Lookup
Email (child)	Input	Email identifier field	NA (child of Login)
Password (child)	Input	Password field	NA (child of Login)
Identity Lookup	Authentication	Required for MFA flows: resolves the identity profile before MFA state is read	MFA Configured State: the resolved identity is what MFA state reads; nothing downstream works without it
MFA Configured State	MFA	Reads registered MFA methods from the resolved profile and routes by method type	Send Email (Email OTP) · Web Page (Phone) (SMS OTP) · Configure MFA (nothing registered or backup-code only)
Configure MFA	MFA	Always paired with MFA Configured State: handles users with no MFA registered; set MFA Flow = `Mandatory`	Web Page (Phone) via its SMS OTP output: routes unconfigured users into the SMS setup path
Send Email	Communication	Dispatches Email OTP; type = `secondfactorauthentication`	Verify OTP Web Page: user enters the code they received
Send SMS	Communication	Dispatches SMS OTP; type = `secondfactorauthentication`	Verify OTP Web Page: user enters the code they received
Verify OTP (Web Page × 2)	Input	Renders the OTP entry screen; contains OTP Input child	Verify Email/SMS OTP: submits the entered code for validation
OTP Input (child)	Input	Input field for the one-time code	NA (child of Verify OTP Web Page)
Update MFA Phone	MFA	Saves the phone number to the MFA profile after OTP verification succeeds: ensures the number is only persisted once the user proves ownership	Success Final
Verify Email/SMS OTP (× 2)	MFA	Validates the submitted OTP code	Success Final (True) · Failure Final (False)
Success Final	NA	Session established	NA
Failure Final	NA	MFA verification failed	NA

Key Design Decisions

Skipping Identity Lookup before MFA Configured State

Identity Lookup → MFA Configured State is a fixed ordering. MFA Configured State reads the session identity context that Identity Lookup populates. Without it, MFA state has no profile to read and will fail.

Login Web Page → MFA Configured State

Login Web Page → Identity Lookup → MFA Configured State

MFA Configured State without Configure MFA

MFA Configured State must always have a Configure MFA node on its Failure output (and any other "not configured" output). Without it, users with no MFA registered hit a dead end. Set MFA Flow = Mandatory on Configure MFA to enforce setup.

MFA Configured State Failure → unconnected

MFA Configured State Failure → Configure MFA (MFA Flow = Mandatory)

Update MFA Phone must come after Verify Email/SMS OTP

The phone number should only be saved to the user's MFA profile once the OTP has been verified: confirming the user actually owns that number. Placing Update MFA Phone before Verify Email/SMS OTP would persist an unverified number.

Verify Email/SMS OTP (true) → Update MFA Phone → Success (correct: phone proven before saving)

Update MFA Phone → Verify Email/SMS OTP (wrong: saves unverified number)

Wire Resend on every OTP screen

The Verify OTP Web Page exposes a Resend output. Wire it back to the relevant Send Email or Send SMS node so users can request a new code without restarting the entire flow.

Verify OTP Web Page (Resend) → Send Email or Send SMS