step-up-authentication

Keycloak Workshop for Step Up with MFA Biometrics Authentication (Passkeys) and Passwordless experience with Passkeys

How to implement Step-up Authentication using Amazon Cognito

Presence human-verification plugin for Kong Gateway

Step-up authentication for a Claude agent: destructive actions are held until a fresh human re-authentication, checked server-side on auth_time freshness. Built with Kinde.

Keycloak 26.x PoC: choose the login method (password / passkey / X.509) from the requested OIDC acr_values, natively via client policies. Includes docker-compose, realm import, Postman collection, and tests.

Sessions as records about a subject and a tenant: device lists, per-account revocation, replay detection, step-up re-authentication, concurrency caps and pluggable stores.

A typed Node service that decides when a fintech payment event needs a fresh phone OTP, with zod-validated bodies and an auditable decision record.

Go library implementing RFC 9470 OAuth 2.0 Step-Up Authentication Challenge

Auth0 for AI Agents — demo técnico de autorización escalonada (scope OAuth, step-up MFA, Guardian push HIL asíncrono) para agentes de IA que ejecutan pagos en banca corporativa.

Linked accounts and role hats for Payload: one person switches between their approved accounts, and acts in one role at a time, with a second factor before switching up.

Go ForwardAuth middleware for Traefik and Nginx, with chained authentication, sessions, step-up checks, and net/http and Fiber adapters.

One-call phone approval (push MFA) for .NET apps

Single sign-on (SSO) and step-up authentication (MFA re-auth) demo: React, Angular and ASP.NET MVC apps, a .NET API and Keycloak using OIDC, PKCE, acr_values and max_age (RFC 9470).

Open-source Next.js neobank reference app: passkey sign-up, KYC and AML onboarding, passkey step-up on large transfers and fraud signals with Didit

Step-up authentication and transaction confirmation in Telegram, WhatsApp: the backend in Python, Node.js, Go, PHP and ASP.NET Core asks the account owner to confirm a sensitive action