Optionalacr_ACR values for step-up (optional, default: MFA policy URI)
Target API audience (required)
OptionalpopupPopup window height (optional, default: 600)
OptionalpopupPopup window width (optional, default: 400)
OptionalpromptOIDC prompt parameter (optional, default: not sent).
When omitted, Auth0 will use the existing session and skip straight to
the MFA challenge if the user is already authenticated. Set to "login"
to force full re-authentication (username + password + MFA).
OptionalreturnReturn URL after authentication (optional, default: '/')
OptionalscopeSpace-separated scopes (optional — inherits global config when omitted)
OptionaltimeoutTimeout in milliseconds (optional, default: 60000)
Options for ClientMfaClient.challengeWithPopup | mfa.challengeWithPopup().
Controls the popup MFA step-up flow: which API audience to target, scopes to request, and popup window behavior.
Example