The client specified not to prompt, but the client app requires re-authentication or MFA

Questions OAuth/OIDC
9

Hi @cat

When accessing the authorization endpoint and having the app level MFA prompt, there is a stateToken generated which is used to prompt for MFA.

If you are using a custom domain, you can update the login page for the custom domain URL and capture the stateToken as follows:

var config = OktaUtil.getSignInWidgetConfig();
if (config.stateToken) 
	window.location.href= 'https://your.app.com/widget.html?token=' + config.stateToken;

Once Okta redirects to widget.html, you can grab the token from the query parameter and use it in the widget’s code as follows:

var oktaSignIn = new OktaSignIn({
    baseUrl: "https://custom.domain.com",
    stateToken: 'token-from-query-param'
    ....
});

This will allow your users to be prompted for MFA on your website successfully.