> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gosentrix.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Step-Up Authentication

> Learn about step-up authentication for sensitive operations

Step-up authentication provides an additional layer of security for sensitive operations.

## What is Step-Up Authentication?

Step-up authentication requires users to re-authenticate (typically with MFA) before performing sensitive operations, even if they're already logged in.

## When is Step-Up Required?

Step-up authentication is required for:

* Disabling SSO
* Deleting custom domains
* Regenerating MFA recovery codes
* Changing tenant settings
* Accessing audit logs
* Break-glass operations

## How It Works

1. User attempts a sensitive operation
2. API returns `403 Forbidden` with `requires_step_up: true`
3. User calls `/api/v1/sessions/elevate` with MFA code
4. User receives elevated access token
5. User retries the original operation with elevated token

## Example Flow

<Steps>
  <Step title="Attempt Sensitive Operation">
    ```bash theme={null}
    curl -X DELETE https://cp.gosentrix.io/api/v1/tenants/{id}/domains/{domain_id} \
      -H "Authorization: Bearer REGULAR_TOKEN"
    ```

    Response: `403 Forbidden - Step-up authentication required`
  </Step>

  <Step title="Elevate Session">
    ```bash theme={null}
    curl -X POST https://api.gosentrix.io/api/v1/sessions/elevate \
      -H "Authorization: Bearer REGULAR_TOKEN" \
      -d '{"mfa_code": "123456"}'
    ```

    Response: Elevated access token
  </Step>

  <Step title="Retry with Elevated Token">
    ```bash theme={null}
    curl -X DELETE https://cp.gosentrix.io/api/v1/tenants/{id}/domains/{domain_id} \
      -H "Authorization: Bearer ELEVATED_TOKEN"
    ```

    Response: `204 No Content` (success)
  </Step>
</Steps>

## Elevated Session Duration

Elevated sessions last **15 minutes** from the time of elevation.

## Best Practices

* Always check for `requires_step_up` in error responses
* Prompt users for MFA when step-up is required
* Cache elevated tokens for the session duration
* Clear elevated tokens on logout