VersolaVersola/docs
versola.kzGitHub
RUEN

RFC 8176 — Authentication Method Reference

AMR values in ID tokens describing how a user authenticated

Specification: RFC 8176

The amr (Authentication Method Reference) claim in OpenID Connect ID tokens lists the authentication methods used during a session. Versola populates amr based on the factors a user passed during the authorization conversation.

Implemented AMR Values

  • pwd — password-based authentication
  • otp — one-time password (numeric code)
  • sms — OTP delivered via SMS channel (paired with otp)
  • hwk — proof-of-possession of a hardware-secured key (device-bound passkey)
  • swk — proof-of-possession of a software-secured key (synced / multi-device passkey)
  • user — user presence confirmed (WebAuthn UP flag)
  • mfa — multiple distinct authentication factors were performed

Not Implemented

  • pin — PIN code
  • face — facial recognition
  • fpt — fingerprint biometric
  • geo — geographic location (corroborating evidence)
  • kba — knowledge-based authentication
  • sc — smart card
  • tel — telephone call confirmation
  • wia — Windows Integrated Authentication

Multi-Factor Logic

When a user passes two or more distinct authentication factors (e.g. password + OTP, or passkey + OTP), the mfa value is automatically added to the amr set in the ID token.

The amr claim is accompanied by:

  • auth_time — Unix timestamp of when authentication occurred
  • acr — Authentication Context Class Reference (configurable per client)