Multi Factor Authentication in PnP Flutter SDK
At Web3Auth, we prioritize your security by offering Multi-Factor Authentication (MFA). MFA is an extra layer of protection that verifies your identity when accessing your account. To ensure ownership, you must provide two or more different backup factors. You have the option to choose from the device, social, backup factor (seed phrase), and password factors to guarantee access to your Web3 account. Once you create a recovery factor, MFA is enabled, and your keys are divided into three shares for off-chain multi-sig, making the key self-custodial. With backup factors, you can easily recover your account if you lose access to your original device or helps login into a new device.
This is a paid feature and the minimum pricing plan to use this
SDK in a production environment is the SCALE Plan. You can use this feature in sapphire_devnet
for free.
Enable using the MFA Level
For a dApp, we provide various options to set up Multi-Factor Authentication. You can customize the
MFA screen by passing the mfaLevel
parameter in login
method. You can enable or disable a backup
factor and change their order. Currently, there are four values for MFA level.
If you are using default verifiers, your users may have set up MFA on other dApps that also use default Web3Auth verifiers. In this case, the MFA screen will continue to appear if the user has enabled MFA on other dApps. This is because MFA cannot be turned off once it is enabled.
MFA Level Options
MFA Level | Description |
---|---|
DEFAULT | Shows the MFA screen every third login. |
OPTIONAL | Shows the MFA screen on every login, but user can skip it. |
MANDATORY | Makes it mandatory to set up MFA after first login. |
NONE | Skips the MFA setup screen |
Usage
Web3AuthFlutter.login(
LoginParams(
loginProvider: Provider.google,
mfaLevel: MFALevel.MANDATORY,
),
);
Explicitly enable MFA
The enableMFA
method is used to trigger MFA setup flow for users. The method takes LoginParams
which will used during custom verifiers. If you are using default login providers, you don't need to
pass LoginParams
. If you are using custom jwt verifiers, you need to pass the JWT token in
loginParams
as well.
- Default Verifier
- Custom JWT Verifier
try {
await Web3AuthFlutter.enableMFA();
} on UserCancelledException {
log("User cancelled.");
} catch(e) {
log("Unknown exception occurred");
}
try {
final loginParams = LoginParams(
loginProvider: Provider.jwt,
extraLoginOptions: ExtraLoginOptions(
id_token: "YOUR_JWT_TOKEN",
),
);
await Web3AuthFlutter.enableMFA(loginParams);
} on UserCancelledException { log("User cancelled."); } catch(e) { log("Unknown exception
occurred"); }
Configure MFA Settings
You can configure the order of MFA, and enable or disable MFA type by passing the mfaSettings
parameter in Web3AuthOptions
during initialization.
- At least two factors are mandatory when setting up the mfaSettings.
- If you set
mandatory: true
for all factors, the user must set up all four factors. - If you set
mandatory: false
for all factors, the user can skip setting up MFA. But at least two factors are mandatory. - If you set
mandatory: true
for some factors andmandatory: false
for others, the user must set up the mandatory factors and can skip the optional factors. But, the user must set up at least two factors. - The
priority
field is used to set the order of the factors. The factor with the lowest priority will be the first factor to be set up. The factor with the highest priority will be the last factor to be set up.
Parameters - MfaSettings
MfaSettings
allows you to set the type of the MFA.
- Table
- Class
Parameter | Description |
---|---|
deviceShareFactor? | MFA setting for deviceShareFactor. It accepts MfaSetting as a value. |
backUpShareFactor? | MFA setting for backUpShareFactor. It accepts MfaSetting as a value. |
socialBackupFactor? | MFA setting for socialBackupFactor. It accepts MfaSetting as a value. |
passwordFactor? | MFA setting for passwordFactor. It accepts MfaSetting as a value. |
class MfaSettings {
final MfaSetting? deviceShareFactor;
final MfaSetting? backUpShareFactor;
final MfaSetting? socialBackupFactor;
final MfaSetting? passwordFactor;
MfaSettings({
this.deviceShareFactor,
this.backUpShareFactor,
this.socialBackupFactor,
this.passwordFactor,
});
Map<String, dynamic> toJson() {
return {
'deviceShareFactor': deviceShareFactor,
'backUpShareFactor': backUpShareFactor,
'socialBackupFactor': socialBackupFactor,
'passwordFactor': passwordFactor,
};
}
}
Parameters - MfaSetting
MfaSetting
allows you to setup MFA setting for a particular MFA type.
- Table
- Class
Parameter | Description |
---|---|
enable | Enable/Disable MFA. It accepts bool as a value. |
priority? | Priority of MFA. It accepts int as a value, where valid range is from 1 to 4. |
mandatory? | Mandatory/Optional MFA. It acccepts bool as a value. |
class MfaSetting {
final bool enable;
final int? priority;
final bool? mandatory;
MfaSetting({required this.enable, this.priority, this.mandatory});
Map<String, dynamic> toJson() {
return {'enable': enable, 'priority': priority, 'mandatory': mandatory};
}
}
Usage
Future<void> initWeb3Auth() async {
late final Uri redirectUrl;
if (Platform.isAndroid) {
redirectUrl = Uri.parse('{SCHEME}://{HOST}/auth');
// w3a://com.example.w3aflutter/auth
} else {
redirectUrl = Uri.parse('{bundleId}://auth');
// com.example.w3aflutter://auth
}
await Web3AuthFlutter.init(
Web3AuthOptions(
clientId: "WEB3AUTH_CLIENT_ID",
network: Network.sapphire_mainnet,
redirectUrl: redirectUrl,
mfaSettings: MfaSettings(
deviceShareFactor: MfaSetting(
enable: true,
priority: 4,
mandatory: true,
),
backUpShareFactor: MfaSetting(
enable: true,
priority: 2,
mandatory: true,
),
socialBackupFactor: MfaSetting(
enable: true,
priority: 3,
mandatory: false,
),
passwordFactor: MfaSetting(
enable: true,
priority: 1,
mandatory: true,
),
),
);
await Web3AuthFlutter.initialize();
}