# @askrjs/auth/mfa

> Published API exports for @askrjs/auth/mfa.

Source: [https://askrjs.com/docs/reference/api/auth/mfa](https://askrjs.com/docs/reference/api/auth/mfa)

Status: stable. Packages: @askrjs/auth/mfa.

**Published packages are authoritative.** Examples may lag behind a published contract. When guidance differs, verify the exports and TypeScript declarations in your installed package, then file an issue.

## Exports

This entrypoint publishes 21 exports from the declarations shipped by @askrjs/auth.

### `CborDecodeOptions`

```ts
CborDecodeOptions: any
```

Resource limits applied while decoding CBOR.

- `maxBytes`: Maximum encoded input bytes.

- `maxDepth`: Maximum nesting depth.

- `maxCollectionLength`: Maximum array or map entries.

### `CborFirstResult`

```ts
CborFirstResult: any
```

Decoded CBOR value and the number of consumed bytes.

- `value`: Decoded value.

- `bytesRead`: Number of bytes consumed from the input.

### `CoseAlgorithm`

```ts
CoseAlgorithm: -7 | -257 | -8
```

COSE algorithm identifiers supported for WebAuthn public keys.

### `createTotpProvisioningUri`

```ts
createTotpProvisioningUri: (input: { secret: string; issuer: string; account: string; } & TotpOptions) => string
```

Build an `otpauth://` URI for authenticator enrollment.

### `decodeCbor`

```ts
decodeCbor: (input: Uint8Array, options?: CborDecodeOptions) => unknown
```

Decode one complete CBOR value.

### `decodeCborFirst`

```ts
decodeCborFirst: (input: Uint8Array, options?: CborDecodeOptions) => CborFirstResult
```

Decode the first CBOR value, allowing trailing bytes.

### `decodeCosePublicKey`

```ts
decodeCosePublicKey: (input: Uint8Array) => DecodedCosePublicKey
```

Decode a COSE public key into an algorithm and Web Crypto JWK.

### `DecodedCosePublicKey`

```ts
DecodedCosePublicKey: any
```

Public-key algorithm and Web Crypto representation decoded from COSE.

- `algorithm`: COSE algorithm identifier.

- `publicKeyJwk`: Equivalent Web Crypto JWK.

### `generateTotpSecret`

```ts
generateTotpSecret: (options?: { byteLength?: number; }) => string
```

Generate a cryptographically random Base32 TOTP secret.

### `MfaValidationError`

```ts
MfaValidationError: typeof MfaValidationError
```

Error raised when MFA input or credentials fail validation.

- `code`: Error category used for programmatic handling.

- `name`: Error category used for programmatic handling.

### `MfaValidationErrorCode`

```ts
MfaValidationErrorCode: "malformed-input" | "credential-mismatch" | "invalid-challenge" | "invalid-origin" | "invalid-rp-id" | "user-presence-required" | "user-verification-required" | "unsupported-algorithm" | "invalid-attestation" | "invalid-signature" | "counter-rollback"
```

Stable failure codes for MFA and WebAuthn validation.

### `TotpAlgorithm`

```ts
TotpAlgorithm: "SHA-1" | "SHA-256" | "SHA-512"
```

Hash algorithms supported by TOTP.

### `TotpOptions`

```ts
TotpOptions: any
```

Shared TOTP generation and verification settings.

- `algorithm`: HMAC hash algorithm. Defaults to SHA-1.

- `digits`: Number of digits in generated codes.

- `periodSeconds`: Validity period in seconds.

### `TotpVerificationResult`

```ts
TotpVerificationResult: {
  valid: true;
  /**
   * Accepted moving counter. The application must atomically reject an already-consumed
   * counter and persist a newly accepted counter to provide replay protection.
   */
  counter: number;
  /** Matched offset from the current counter; useful for application-owned clock-drift policy. */
  drift: number;
} | {
  valid: false;
  counter?: never;
  drift?: never;
}
```

Result of verifying a TOTP code.

### `verifyTotpCode`

```ts
verifyTotpCode: (input: VerifyTotpOptions) => Promise<TotpVerificationResult>
```

Verify a TOTP code with a bounded clock-drift window.

The window is scanned from `-window` through `+window`. If the same code matches more than one
counter, the last match wins, so the greatest numeric drift (toward `+window`) is returned.

A valid cryptographic result alone does not prevent replay. The caller must atomically consume
and persist the returned `counter` before granting access:

```ts
const result = await verifyTotpCode({ secret, code });
if (result.valid && await counters.consume(result.counter)) grantAccess();
```

### `VerifyTotpOptions`

```ts
VerifyTotpOptions: any
```

Input required to verify one TOTP code.

- `secret`: Base32-encoded shared secret.

- `code`: User-entered one-time code.

- `at`: Verification time; defaults to the current time.

- `window`: Number of adjacent periods accepted on either side.

### `verifyWebAuthnAuthentication`

```ts
verifyWebAuthnAuthentication: (input: WebAuthnAuthenticationInput) => Promise<{ signCount: number; backupEligible: boolean; backedUp: boolean; }>
```

Verify a WebAuthn assertion against a stored credential.

### `verifyWebAuthnRegistration`

```ts
verifyWebAuthnRegistration: (input: WebAuthnRegistrationInput) => Promise<WebAuthnRegistrationResult>
```

Verify a WebAuthn registration ceremony and decode its public key.

### `WebAuthnAuthenticationInput`

```ts
WebAuthnAuthenticationInput: any
```

Server-side WebAuthn authentication ceremony data.

- `credentialId`: Credential identifier returned by the browser.

- `storedCredentialId`: Credential identifier stored during registration.

- `publicKeyJwk`: Stored public-key JWK.

- `authenticatorData`: Authenticator data bytes.

- `clientDataJSON`: Browser client-data JSON bytes.

- `signature`: Assertion signature bytes.

- `expectedChallenge`: Challenge originally issued by the server.

- `allowedOrigins`: Allowed origins for this ceremony.

- `rpId`: Relying-party identifier.

- `signCount`: Previously stored signature counter.

- `requireUserVerification`: Require user verification.

### `WebAuthnRegistrationInput`

```ts
WebAuthnRegistrationInput: any
```

Server-side WebAuthn registration ceremony data.

- `credentialId`: Credential identifier returned by the browser.

- `clientDataJSON`: Browser client-data JSON bytes.

- `attestationObject`: Browser attestation object bytes.

- `expectedChallenge`: Challenge originally issued by the server.

- `allowedOrigins`: Allowed origins for this ceremony.

- `rpId`: Relying-party identifier.

- `requireUserVerification`: Require user verification.

### `WebAuthnRegistrationResult`

```ts
WebAuthnRegistrationResult: any
```

Verified credential data persisted after registration.

- `credentialId`: Credential identifier to persist.

- `publicKeyJwk`: Public key to persist.

- `algorithm`: COSE algorithm identifier.

- `signCount`: Initial signature counter.

- `aaguid`: Authenticator AAGUID.

- `backupEligible`: Whether the credential may be backed up.

- `backedUp`: Whether the credential is currently backed up.

## Documentation navigation

[Previous](https://askrjs.com/docs/reference/api/auth/saml/index.md) | [Next](https://askrjs.com/docs/reference/api/auth/webauthn-client/index.md)