Implement step-up authentication using acr_values and max_age

Steps

1. Detect at your resource server that the current access token's acr claim does not meet the required assurance level for the requested operation (e.g., the resource requires MFA but the token was issued with password-only authentication).
2. Return a 401 response with a WWW-Authenticate or application-level challenge indicating the required acr value; for APIs following RFC 9470, include insufficient_user_authentication in the error body with acr_values and optionally max_age.
3. The client initiates a new authorization request to the OP, including acr_values set to the required assurance level (e.g., a space-separated list ordered by preference) or the claims parameter requesting the acr claim as essential.
4. Optionally include max_age to require the user to have authenticated within the specified number of seconds, forcing re-authentication if their last auth is too old.
5. After the step-up flow completes, the OP returns a new token with the elevated acr claim; the client retries the original request with the new token.
6. Validate the acr claim in the new token at your resource server to confirm the required assurance level was achieved before granting access.