Skip to content

Multi-Factor Authentication

Next-level security for your app

Unlock advanced authentication methods using authenticator apps (TOTP) and SMS passcodes.

Add MFA to your appRead the docs
Multi-Factor Authentication
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Your app. Your rules. Secure by design.

Enroll, activate, and verify authentication factors

1

Enroll

Register an additional factor for a user — a time-based one-time password from an authenticator app, or a phone number for SMS passcodes. You get back a QR code payload and a secret.

2

Activate

The user proves possession once by entering the first code. Until they do, the factor stays pending, so a half-finished setup never locks anyone out.

3

Verify

Challenge the factor at sign-in, or later, before anything that really matters. The verification endpoint answers with a simple valid or not, and you decide what happens next.

Authenticator apps

Support authenticator apps for an extra layer of security

Enforce additional security measures by asking users to prove possession of their device using apps like 1Password, Google Authenticator, and Duo.

  • Standards-based TOTP — any RFC 6238 authenticator works, including the ones your customers already mandate
  • QR code and manual-entry secret returned from the same enrollment call
  • Per-user factor lists, so someone can carry a phone and a hardware-backed app at once
  • Clock-drift tolerance tuned so real users pass and replayed codes do not
Authenticator apps
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Re-verification

Restrict access to sensitive resources with re-verification

Require users to verify their identity with a stronger authentication mechanism when accessing restricted resources or performing sensitive actions.

  • Step up before a payout, a role change, or an export — not only at sign-in
  • Choose between enforcing MFA for all users or making it an opt-in configuration
  • Policies applied per organisation, so one enterprise tenant can require what another does not
  • Failed challenges surface as events you can alert on
Re-verification
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Compatible with your needs

Frictionless integration.

With a few API calls, you can integrate MFA into an existing application, regardless of the authentication layer or session management strategy.

TOTPTime-based one-time passwords supported out of the box, with the issuer and account label under your control so the entry in the user's app carries your brand.
SMSPhone number passcodes enabled with the same interface. Delivery, retries and expiry are handled for you.
Customizable templatesTailor the SMS message delivered to your users to fit your app and brand, rather than shipping a generic vendor string.
Flexible authentication flowsAllow users to configure both TOTP and SMS verification using the same API interface, and let them fall back from one to the other.
Stay in control of the user journeyA composable, unopinionated set of endpoints. Nothing redirects, nothing renders — you decide where the challenge appears.
Every attempt on the recordEnrollments, activations, challenges and failures are emitted as events, ready for your audit trail and your monitoring.

Enroll, activate, and verify

A composable set of endpoints that drops into an existing application.

No session model to adopt, no redirect to accept. Call enroll, then challenge, then verify — from wherever your auth already lives.

1// Register an additional factor of authentication
2// such as Time-based One Time Password (TOTP)
3import Paycux from '@paycux/node';
4 
5const paycux = new Paycux('sk_example_123456');
6 
7await paycux.mfa.enrollFactor({
8  type: 'totp',
9  issuer: 'Foo Corp',
10  user: 'alan.turing@foo-corp.example',
11});

Transparent pricing

Priced by monthly active user

Enrollment and verification are part of the platform. SMS delivery is passed through at cost, so a user who only ever uses an authenticator app never generates a message charge.

See full pricingTalk to an expert
TOTP enrollment and verificationIncluded
SMS passcodesDelivery at cost
Re-verification for sensitive actionsIncluded
Per-organisation MFA policiesIncluded
Custom enterprise plansContact sales

Questions

Frequently asked

Do I have to use Paycux for sign-in to use MFA?

No. The MFA API is unopinionated about your authentication layer and your session management strategy. Keep the login you have and add factors alongside it.

Which authenticator apps are supported?

Any app that implements standard time-based one-time passwords, including 1Password, Google Authenticator and Duo. There is no allowlist to maintain.

Can I require MFA for some customers but not others?

Yes. Policies are configured per organisation, so an enterprise tenant can mandate a second factor while your self-serve tier leaves it optional.

What is re-verification?

A second challenge at the moment of a sensitive action rather than at sign-in — approving a payment, changing a role, exporting data. The same verify endpoint, called later in the session.

What happens if a user loses their device?

Factors can be listed and deleted per user, so your support flow can remove the lost factor and walk the user through enrolling a new one without touching their password.

Keep exploring

The rest of the platform

User ManagementComplete auth and user management platform
Enterprise SSOUnified SSO for any identity provider
RadarRealtime protection against bots, fraud and abuse
AuthKitCustomisable UI for every authentication type
Directory SyncUser lifecycle from corporate directories
Role-Based Access ControlPowerful and flexible permissions for your users

Add Multi-Factor Auth to your app today

Integrate MFA to your app to ensure that you support the latest authentication security protocols.

Get startedTalk to an expert