Enroll a TOTP authentication factor, issue a challenge, and verify the one-time code using the WorkOS MFA API

Documented steps

1. Authenticate all calls with 'Authorization: Bearer <WORKOS_API_KEY>' and 'Content-Type: application/json' against https://api.workos.com.
2. Enroll a factor: POST /auth/factors/enroll with body {"type":"totp","totp_issuer":"<Your App Name>","totp_user":"<user email>"}. For SMS use {"type":"sms","phone_number":"<E.164 number>"}.
3. The response returns an authentication_factor object (id auth_factor_...) including totp.secret, totp.qr_code (base64 PNG data URI), and totp.uri. Render the QR code, and show the secret as a manual fallback.
4. Persist the authentication_factor.id against your user record.
5. If your app is already on AuthKit / User Management, use the user-scoped equivalent instead: POST /user_management/users/{userId}/auth_factors with the same type, totp_issuer, and totp_user body. That endpoint returns both an authentication_factor and an initial authentication_challenge in one call.
6. At login or step-up, issue a challenge: POST /auth/factors/{authentication_factor_id}/challenge. For SMS factors you may pass sms_template containing a {{code}} token.
7. The response returns an authentication_challenge with id auth_challenge_... and expires_at. Prompt the user for the 6-digit code.
8. Verify: POST /auth/challenges/{authentication_challenge_id}/verify with body {"code":"<6-digit code>"}.
9. The response returns {"challenge":{...},"valid":true|false}. Treat the login or step-up as successful only when valid is true.
10. Implement your own attempt limiting and lockout around the verify call, and confirm enrollment by requiring one successful verify before marking the factor active.
11. Reference: https://workos.com/docs/reference/mfa/factor/enroll
12. Reference: https://workos.com/docs/reference/mfa/challenge/verify
13. Reference: https://workos.com/docs/mfa