Authentication method reference (AMR)
The amr claim (RFC 8176) lists how the user authenticated. It is complementary to acr (how strong the finished flow was). See MFA / ACR ladder.
In cidaas, token amr and prelogin amr_values are numeric strings (for example "10" for password via email). Federated IdPs may send RFC 8176 names such as pwd; map those with amrConfig. Custom methods set their own values via pluggable verification.
Each AMR identifies a family of closely related methods. For example, otp covers both time-based and HMAC one-time passwords: many relying parties only need to know that an OTP ran in addition to a password.
cidaas values and RFC 8176 equivalents
cidaas emits the cidaas AMR in tokens. The RFC 8176 column is the closest standard name (for federation mapping and RP interpretation). — means there is no direct registry value.
| Authentication method | cidaas AMR | RFC 8176 |
|---|---|---|
| PASSWORD_EMAIL | 10 | pwd |
| PASSWORD_MOBILE | 11 | pwd |
| PASSWORD_USERNAME | 12 | pwd |
| PASSWORD_CUSTOM_USERNAME | 13 | pwd |
| SECURITY_QUESTION_EMAIL | 30 | kba |
| SECURITY_QUESTION_MOBILE | 31 | kba |
| SECURITY_QUESTION_USERNAME | 32 | kba |
| SECURITY_QUESTION_CUSTOM_USERNAME | 33 | kba |
| FACE_EMAIL | 40 | face |
| FACE_MOBILE | 41 | face |
| FACE_USERNAME | 42 | face |
| FACE_CUSTOM_USERNAME | 43 | face |
| BACKUPCODE_EMAIL | 50 | otp |
| BACKUPCODE_MOBILE | 51 | otp |
| BACKUPCODE_USERNAME | 52 | otp |
| BACKUPCODE_CUSTOM_USERNAME | 53 | otp |
| TOTP_EMAIL | 60 | otp |
| TOTP_MOBILE | 61 | otp |
| TOTP_USERNAME | 62 | otp |
| TOTP_CUSTOM_USERNAME | 63 | otp |
| PATTERN_EMAIL | 70 | pin |
| PATTERN_MOBILE | 71 | pin |
| PATTERN_USERNAME | 72 | pin |
| PATTERN_CUSTOM_USERNAME | 73 | pin |
| PUSH_EMAIL | 80 | mca |
| PUSH_MOBILE | 81 | mca |
| PUSH_USERNAME | 82 | mca |
| PUSH_CUSTOM_USERNAME | 83 | mca |
| VOICE_EMAIL | 90 | vbm |
| VOICE_MOBILE | 91 | vbm |
| VOICE_USERNAME | 92 | vbm |
| VOICE_CUSTOM_USERNAME | 93 | vbm |
| RENEWED | 101 | — |
| SOCIAL_LOGIN | 102 | — |
103 | otp | |
| SMS | 104 | sms |
| GUEST_LOGIN | 105 | — |
| FIDO2 | 106 | hwk / pop |
| FIDOU2F | 107 | hwk |
| TOUCHID | 108 | fpt |
| IVR | 109 | tel |
hwk = hardware-secured key (RFC 8176); pop = proof-of-possession of a key (OpenID EAP), hardware or software unspecified. Map FIDO2 to whichever fits your RP policy.
RFC 8176 registry (standard names)
| Value | Meaning |
|---|---|
face | Facial recognition |
fpt | Fingerprint biometric |
geo | Geolocation |
hwk | Proof-of-possession of a hardware-secured key |
iris | Iris scan biometric |
kba | Knowledge-based authentication |
mca | Multiple-channel authentication (e.g. out-of-band push) |
mfa | Multiple-factor authentication (meta-value; often with concrete methods) |
otp | One-time password |
pin | Personal Identification Number |
pop | Proof-of-possession of a key (OpenID EAP; hardware or software) |
pwd | Password-based authentication |
rba | Risk-based authentication |
retina | Retina scan biometric |
sc | Smart card |
sms | Confirmation using SMS |
swk | Proof-of-possession of a software-secured key |
tel | Confirmation by telephone |
user | User presence test |
vbm | Voice biometric |
wia | Windows integrated authentication |
Full registry: IANA Authentication Method Reference Values.
Please contact us directly on our support page or reach out to cidaas support at [email protected].