Step-up

You see a Confirm it is you prompt. In the account area it opens as a dialog that says This needs a second factor used in the last 30 minutes. A full page with the same title, which says This needs a fresh confirmation., exists for when a link or a refreshed tab lands on it. You choose how to confirm.

• Use a passkey.
• Authenticator code. Type the six digit code from your app (the full page calls it Authenticator app code). This is offered only when your session began with a password.
• A sign-in through your linked provider, for an account that has one.
• Account password, under Other ways to confirm. This is offered only when your session was opened with a passkey or with a provider sign-in that reported a second factor, and your account has a password. It is never offered on a session that began with a password, an email link or a recovery code.

A session opened with the emailed code that replaces a lost passkey has used no second factor, so it must confirm with a passkey or an authenticator code before any step-up action, and the allowance that lets a long-known browser change a sign-in method does not apply to it. An account that an organization manages and that has nothing to answer a step-up with is refused with Your organization manages this account, so this is not available here. Ask your organization’s administrator.

When it works the prompt says Confirmed. and you continue with what you were doing. A step-up asks for a second factor you can produce at that moment. A recovery code is not a way to confirm it is you: it signs you in, but the confirmation prompt does not accept it. A session that signed in with a recovery code must first prove a live authenticator app code or a passkey before it can create new recovery codes, remove the authenticator app or switch the optional extra steps.

In your account#

The account area asks for a step-up before the actions that would change how you sign in, or hand your data to someone.

The second factor must have been used recently enough. The rule is: your session must be at assurance level 2 or higher, and the sign-in or step-up that earned that level must be no more than 30 minutes old. If your last confirmation was longer ago, you are asked again. A session that signed in with a passkey and has stayed open for an hour will ask before one of these actions, and then not ask again for the next 30 minutes.

When an application asks#

An application can ask for a stronger sign-in than your session has. It sends acr_values=aal2 (or aal3) when it starts the sign-in. If your session is below that level, identity sends you to confirm with a stronger method, the same step-up. An application can also send max_age or prompt=login to require a fresh sign-in. With max_age and acr_values=aal2 together, a live session is asked only for a fresh second factor. See Assurance levels.

When an organization requires single sign-on#

An organization can require that its members have signed in through one of its single sign-on connections recently (24 hours by default, within 5 minutes to 7 days). The sign-in page then shows Sign in with your organization and offers Continue with the connection. Where an application or API asks for something the session cannot show, the answer follows RFC 9470: a 400 with the error insufficient_user_authentication, plus the acr_values and max_age the application needs to start the sign-in again. This applies at the token endpoint and on organization API calls. The feature is behind the flag sso_enforcement, which is OFF by default.

When an organization requires it#

An organization can set a minimum assurance level for sign-ins to it. A session below that floor is asked to confirm again. See Organizations.

A step-up does not change your session. It records a confirmation that raises the level you currently have, for a window of time. When the window ends, your level returns to what the session itself earned. Your session, your cookie and your sign-in time are unchanged. The list of methods recorded on the session is not rewritten by a step-up either.

The two figures answer different questions. The 30-minute figure is how fresh your last second-factor check must be when you ask for a sensitive action in your account. The 10-minute figure is how long a confirmation made at the prompt raises your level.

• Too many tries. Step-up attempts are limited per account. After repeated wrong codes, the request is refused and you are told how long to wait: Too many attempts. Try again in a wait given in seconds below a minute, in minutes (rounded up) up to 90 minutes, and in hours beyond that.
• The code is wrong. The prompt says it was not accepted. Authenticator codes change every 30 seconds, and a code that was already used is refused.
• Your session has no second factor to use. If your account has no passkey and no authenticator app, you may have nothing to step up with. Add one first. See Security and passkeys. If a sign-in itself is refused for this reason, recover the account instead: see If a sign-in needs a second factor you do not have.
• You signed in through your organization's connection. Such a session proves nothing locally, so the account area's sensitive actions ask for a step-up on the session itself, with a factor of your own, even if the connection reported a second factor.
• You signed in with the lost-passkey emailed code. That session is at AAL1 and the code can never raise it. On an account that holds a passkey or an authenticator app it cannot end other sessions, leave organizations, accept or decline invitations, add an email address, cancel a recovery, revoke an application's access or mark security events read until you confirm with a second factor used in the last 30 minutes. See Authentication methods.
• You signed in with "Continue with my password only (limited session)". That session is at AAL1. The actions in the table above show Confirm it is you instead of a plain refusal, and a passkey or an authenticator code lifts the limit. Confirming with an authenticator code also makes the browser known to the account, which starts its 24 hours for the changes held back from a new browser. See The second step.
• Your session started in a way that cannot be raised with a code. An authenticator code raises a session only when the session began with a password. A passkey works for any session. The account password works only on a session opened with a passkey or provider MFA.

• Assurance levels
• Sessions
• Sessions and devices