Senior LevelREST APIs & Web Services
How do Multi-Factor Authentication (MFA) TOTP and WebAuthn flows integrate into REST login APIs?
❓ Interview Prompt: Explain 2-step MFA API authentication flow, TOTP validation (`speakeasy`), WebAuthn / FIDO2 passkeys, and temporary MFA session tokens.
Integrating 2-Factor Authentication into REST APIs requires a 2-step login transaction flow:
2-Step MFA API Flow:
1
Client submits 'POST /api/v1/auth/login' with username & password.
2
If credentials match but MFA is enabled, server returns '200 OK' with payload '{ mfaRequired: true, mfaToken: "temp_jwt_token" }' (valid for 5 mins, restricted to MFA verification endpoint ONLY!).
3
Client submits 'POST /api/v1/auth/mfa/verify' passing 'mfaToken' and 6-digit TOTP code ('123456').
4
Server verifies TOTP code and issues full application access and refresh tokens!
Code Implementation Example
typescript
export async function verifyTotpStep(req: Request, res: Response) {
const { mfaToken, totpCode } = req.body;
const payload = verifyTempMfaToken(mfaToken); // Verify temporary MFA token
const isTotpValid = speakeasy.totp.verify({
secret: payload.mfaSecret,
encoding: 'base32',
token: totpCode
});
if (!isTotpValid) return res.status(401).json({ error: 'Invalid 6-digit MFA code' });
// Issue full application tokens!
const accessToken = issueAccessToken(payload.userId);
res.json({ accessToken });
}💡Two-step REST API authentication flow verifying TOTP MFA codes.
🎯 Interview Key Takeaway
Implement REST API MFA using a two-step flow where step 1 returns a temporary restricted MFA token required for step 2 code verification.
#MFA#TOTP#WebAuthn#Authentication#Senior
Back to all REST APIs & Web Services Questions→