Are you requesting Refresh Tokens (with the offline_access scope)?
If not, autoRenew will attempt to get new tokens silently in an iframe with the getWithoutPrompt method, which involves setting the prompt parameter to none in the /authorize request made to Okta. This prevents Okta from being able to prompt the user for MFA
From what I can tell, you could either:
- request the offline_access scope so that refresh tokens are retrieved and used by autoRenew to keep users logged in, but they will not be prompted for MFA (at least as far as I’m aware) for as long as their Refresh Token is active
- after the RT expires, you’re likely going to see the same login_required failure when the SDK relies on the Okta session and getWithoutPrompt method to keep the user logged in, as described above
- set
autoRenewto false and instead handle token renewals yourself, but you will need to use getWithRedirect to ensure that the app redirects back to Okta to log the user (that way, they can be challenged for MFA)