---
descriptions:
  authentication_errors:
    authentication_factors: |
      IDs and types of the [factors](/reference/mfa) the user is enrolled in.
reference:
  json:
    - key: mfa_challenge_error
      id: mfa_challenge_error
      url: /reference/authkit/authentication-errors/mfa-challenge-error
      title: mfa_challenge
      properties:
        - key: code
          type: '"mfa_challenge"'
          description: (authentication_errors.code)
        - key: message
          type: string
          description: (authentication_errors.message)
        - key: pending_authentication_token
          type: string
          description: (authentication_errors.pending_authentication_token)
        - key: authentication_factors
          type: array
          description: (authentication_errors.authentication_factors)
        - key: user
          type: user
          description: (user.self)
originalPath: >-
  .tmp-workos-clone/packages/docs/content/reference/authkit/authentication-errors/mfa-challenge-error.mdx
---

## MFA challenge error

This error indicates that a user enrolled into MFA attempted to authenticate in an environment where MFA is required. It includes a pending authentication token and a list of factors that the user is enrolled in that should be used to complete the authentication.

<CodeBlock
  title="MFA challenge error"
  referenceId="mfa_challenge_error"
  file="mfa-challenge-error"
/>

When this error occurs, you’ll need to present an MFA challenge UI to the user and authenticate them with their [TOTP code](/reference/authkit/authentication/totp), the pending authentication token from this error, and a [challenge](/reference/mfa/challenge/create) that corresponds to one of the authentication factors.

MFA can be enabled via the [Authentication page](https://dashboard.workos.com/authentication) in the WorkOS dashboard.