Skip to content

Authentication method references

reauth.amr

Authentication Method Reference Values (amr) per RFC 8176.

This module defines the standard Authentication Method Reference values as specified in RFC 8176 for use in JWT amr claims. These values represent the authentication methods used in an authentication event.

See: https://datatracker.ietf.org/doc/html/rfc8176

AuthenticationMethodReference

Bases: StrEnum

Standard Authentication Method Reference values (amr) per RFC 8176.

These values are used in the 'amr' claim of JSON Web Tokens (JWT) to identify the authentication methods used in an authentication event.

Each value represents a family of closely related authentication methods. The registry is maintained by IANA and is extensible.

FACE class-attribute instance-attribute 

FACE = 'face'

Facial recognition biometric authentication.

FPT class-attribute instance-attribute 

FPT = 'fpt'

Fingerprint biometric authentication.

IRIS class-attribute instance-attribute 

IRIS = 'iris'

Iris scan biometric authentication.

RETINA class-attribute instance-attribute 

RETINA = 'retina'

Retina scan biometric authentication.

VBM class-attribute instance-attribute 

VBM = 'vbm'

Voice biometric authentication.

KBA class-attribute instance-attribute 

KBA = 'kba'

Knowledge-based authentication (e.g., security questions).

PIN class-attribute instance-attribute 

PIN = 'pin'

Personal Identification Number or pattern authentication.

PWD class-attribute instance-attribute 

PWD = 'pwd'

Password-based authentication.

HWK class-attribute instance-attribute 

HWK = 'hwk'

Proof-of-Possession of a hardware-secured key.

OTP class-attribute instance-attribute 

OTP = 'otp'

One-time password (HOTP/TOTP).

SC class-attribute instance-attribute 

SC = 'sc'

Smart card authentication.

SWK class-attribute instance-attribute 

SWK = 'swk'

Proof-of-Possession of a software-secured key.

SMS class-attribute instance-attribute 

SMS = 'sms'

SMS text message confirmation.

TEL class-attribute instance-attribute 

TEL = 'tel'

Telephone call confirmation.

EMAIL class-attribute instance-attribute 

EMAIL = 'email'

Email-based OTP or magic link authentication.

This is a custom extension to RFC 8176, not part of the standard.

OAUTH2 class-attribute instance-attribute 

OAUTH2 = 'oauth2'

OAuth 2.0 authentication, including social login.

This is a custom extension to RFC 8176, not part of the standard.

MFA class-attribute instance-attribute 

MFA = 'mfa'

Multiple-factor authentication.

MCA class-attribute instance-attribute 

MCA = 'mca'

Multiple-channel authentication.

RBA class-attribute instance-attribute 

RBA = 'rba'

Risk-based authentication.

GEO class-attribute instance-attribute 

GEO = 'geo'

Geolocation-based authentication.

USER class-attribute instance-attribute 

USER = 'user'

User presence test.

WIA class-attribute instance-attribute 

WIA = 'wia'

Windows Integrated Authentication.