First updates for Advanced Factor Config

[avanscoy]

Description

Update existing pages with AFC, Code Length and Code Lifetime

References

Testing

Checklist

• I've read and followed CONTRIBUTING.md.
• I've tested the site build for this change locally.
• I've made appropriate docs updates for any code or config changes.
• I've coordinated with the Product Docs and/or Docs Management team about non-trivial changes.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
auth0	🟢 Ready	View Preview	Aug 5, 2026, 7:43 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
auth0-docs-dev	🟢 Ready	View Preview	Aug 5, 2026, 7:43 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
auth0-docs-staging	🟢 Ready	View Preview	Aug 5, 2026, 7:44 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[github-actions]

Summary

Status	Count
🔍 Total	274
✅ Successful	26
⏳ Timeouts	0
🔀 Redirected	13
👻 Excluded	224
❓ Unknown	0
🚫 Errors	11
⛔ Unsupported	0

Errors per input

Errors in main/docs/secure/multi-factor-authentication/auth0-guardian.mdx

• [404] https://firebase.google.com/docs/cloud-messaging/concept-options | Rejected status code (this depends on your "accept" configuration): Not Found

Errors in main/docs/secure/multi-factor-authentication/auth0-guardian/guardian-for-android-sdk.mdx

• [ERROR] http://search.maven.org/#search%7Cgav%7C1%7Cg%3A%22com.auth0.android%22%20AND%20a%3A%22guardian%22 | Cannot find fragment: Fragment not found in document. Check if fragment exists or page structure
• [410] https://bintray.com/auth0/android/guardian | Rejected status code (this depends on your "accept" configuration): Gone
• [ERROR] https://firebase.google.com/docs/cloud-messaging/android/client#sample-register | Cannot find fragment: Fragment not found in document. Check if fragment exists or page structure

Errors in main/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa.mdx

• [403] https://support.twilio.com/hc/en-us/articles/223132387-Protect-your-Twilio-project-from-Fraud-with-Usage-Triggers | Rejected status code (this depends on your "accept" configuration): Forbidden
• [403] https://support.twilio.com/hc/en-us/articles/223180048-Adding-a-Verified-Phone-Number-or-Caller-ID-with-Twilio | Rejected status code (this depends on your "accept" configuration): Forbidden
• [403] https://support.twilio.com/hc/en-us/articles/223180228-International-Voice-Dialing-Geographic-Permissions-Geo-Permissions-and-How-They-Work | Rejected status code (this depends on your "accept" configuration): Forbidden
• [403] https://support.twilio.com/hc/en-us/articles/223181108-How-International-SMS-Permissions-work | Rejected status code (this depends on your "accept" configuration): Forbidden
• [404] https://www.twilio.com/docs/sms/services/services-send-messages | Rejected status code (this depends on your "accept" configuration): Not Found
• [404] https://www.twilio.com/help/faq/twilio-basics/what-is-an-application-sid | Rejected status code (this depends on your "accept" configuration): Not Found
• [404] https://www.twilio.com/learn/voice-and-video/toll-fraud | Rejected status code (this depends on your "accept" configuration): Not Found

Redirects per input

Redirects in main/docs/secure/multi-factor-authentication/auth0-guardian/guardian-for-android-sdk.mdx

• [200] http://search.maven.org/ | Redirect: Followed 1 redirect resolving to the final status of: OK. Redirects: http://search.maven.org/ --> https://search.maven.org/
• [200] https://github.com/auth0/GuardianSDK.Android/releases | Redirect: Followed 1 redirect resolving to the final status of: OK. Redirects: https://github.com/auth0/GuardianSDK.Android/releases --> https://github.com/auth0/Guardian.Android/releases

Redirects in main/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/enroll-challenge-sms-voice-authenticators.mdx

• [200] https://en.wikipedia.org/wiki/e.164 | Redirect: Followed 1 redirect resolving to the final status of: OK. Redirects: https://en.wikipedia.org/wiki/e.164 --> https://en.wikipedia.org/wiki/E.164

Redirects in main/docs/secure/multi-factor-authentication/configure-cisco-duo-for-mfa.mdx

• [200] http://duosecurity.com/ | Redirect: Followed 2 redirects resolving to the final status of: OK. Redirects: http://duosecurity.com/ --> https://duosecurity.com/ --> https://duo.com/
• [200] https://itunes.apple.com/us/app/duo-mobile/id422663827?mt=8 | Redirect: Followed 1 redirect resolving to the final status of: OK. Redirects: https://itunes.apple.com/us/app/duo-mobile/id422663827?mt=8 --> https://apps.apple.com/us/app/duo-mobile/id422663827

Redirects in main/docs/secure/multi-factor-authentication/manage-mfa-auth0-apis/manage-authenticator-factors-mfa-api.mdx

• [200] https://auth0.com/docs/api/authentication/muti-factor-authentication/request-mfa-challenge | Redirect: Followed 1 redirect resolving to the final status of: OK. Redirects: https://auth0.com/docs/api/authentication/muti-factor-authentication/request-mfa-challenge --> https://auth0.com/docs/api/authentication/multi-factor-authentication/request-mfa-challenge
• [200] https://auth0.com/docs/api/authentication/muti-factor-authentication/verify-mfa-with-otp | Redirect: Followed 1 redirect resolving to the final status of: OK. Redirects: https://auth0.com/docs/api/authentication/muti-factor-authentication/verify-mfa-with-otp --> https://auth0.com/docs/api/authentication/multi-factor-authentication/verify-mfa-with-otp
• [200] https://auth0.com/docs/api/management/v2/tokens | Redirect: Followed 1 redirect resolving to the final status of: OK. Redirects: https://auth0.com/docs/api/management/v2/tokens --> https://auth0.com/docs/secure/tokens/access-tokens/management-api-access-tokens

Redirects in main/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa.mdx

• [200] https://www.twilio.com/console/voice/calls/geo-permissions | Redirect: Followed 1 redirect resolving to the final status of: OK. Redirects: https://www.twilio.com/console/voice/calls/geo-permissions --> https://www.twilio.com/login?g=%2Fconsole%2Fvoice%2Fcalls%2Fgeo-permissions%3F&t=03c5d64e83e73e958c125ea0f30bd6efe4337dc371da77182601811d3ecc342e
• [200] https://www.twilio.com/help/faq/twilio-basics/what-is-the-auth-token-and-how-can-i-change-it | Redirect: Followed 2 redirects resolving to the final status of: OK. Redirects: https://www.twilio.com/help/faq/twilio-basics/what-is-the-auth-token-and-how-can-i-change-it --> https://support.twilio.com/hc/en-us/articles/223136027-Auth-Tokens-and-How-to-Change-Them --> https://support.twilio.com/hc/en-us/articles/223136027-How-to-Find-Your-Auth-Token-and-How-to-Change-It
• [200] https://www.twilio.com/sms | Redirect: Followed 3 redirects resolving to the final status of: OK. Redirects: https://www.twilio.com/sms --> https://www.twilio.com/en-us/sms --> https://www.twilio.com/en-us/messaging/channels/sms.html --> https://www.twilio.com/en-us/messaging/channels/sms
• [200] https://www.twilio.com/voice | Redirect: Followed 1 redirect resolving to the final status of: OK. Redirects: https://www.twilio.com/voice --> https://www.twilio.com/en-us/voice

Redirects in main/docs/secure/multi-factor-authentication/step-up-authentication/configure-step-up-authentication-for-web-apps.mdx

• [200] https://tools.ietf.org/html/rfc8176 | Redirect: Followed 1 redirect resolving to the final status of: OK. Redirects: https://tools.ietf.org/html/rfc8176 --> https://datatracker.ietf.org/doc/html/rfc8176
  Full Github Actions output

[andy317fe301f8c7]

Reviewed against the current head commit and cross-checked the OTP/remember-me ranges directly against the live atko-cic/api2 schema and atko-cic/auth0-server code (not just the PRD). A few earlier concerns (SMS OTP length lower bound, TOTP-app digit count, a typo) are already fixed in this revision. Left inline comments on what's still open — mostly range/units accuracy and two documentation gaps for settings that are already live via the Management API but not yet documented here.

[andy317fe301f8c7]

Same issue as the range table above — "5 and 60 minutes" should be "0.5 and 60 minutes" if the true floor is 30 seconds, pending confirmation from eng on whether the Dashboard enforces a stricter minimum than the API.

[avanscoy]

Pending Engineering. Auth0 Dashboard is still showing 5 to 60 minutes.

[andy317fe301f8c7]

This section ("Change frequency of MFA prompts") only has Dashboard and Actions tabs. There's a real, GA Management API path for these same settings that isn't documented anywhere on this page:

• GET/PUT /api/v2/guardian/settings (gated behind mfa_advanced_factor_config flag + update:tenant_settings scope)
• Fields mfa_session_inactivity_timeout / mfa_session_overall_timeout (seconds), nested under universal_login.*
• Confirmed the reader (auth0-server's buildTenantTimeoutConfig) and writer (this api2 endpoint) are aligned today — the field-mismatch bug between them was fixed by PR auth0-server#19166, merged 2026-08-12.

Suggest adding a third "Management API" tab here with GET/PUT + JSON examples, matching the pattern already used in the OTP-settings sections on the email/SMS pages, and noting the feature-flag/entitlement requirement.