> ## Documentation Index
> Fetch the complete documentation index at: https://docs-dev-fix-docs-5525.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> Learn how to use the Auth0 Management API to manage MFA authentication methods for your users.

# Manage Authentication Methods with Management API

export const AuthCodeGroup = ({children, dropdown}) => {
  const [processedChildren, setProcessedChildren] = useState(children);
  useEffect(() => {
    let unsubscribe = null;
    function init() {
      unsubscribe = window.autorun(() => {
        const processChildren = node => {
          if (typeof node === "string") {
            let processedNode = node;
            for (const [key, value] of window.rootStore.variableStore.values.entries()) {
              const escapedKey = key.replaceAll(/[.*+?^${}()|[\]\\]/g, (String.raw)`\$&`);
              processedNode = processedNode.replaceAll(new RegExp(escapedKey, "g"), value);
            }
            return processedNode;
          } else if (Array.isArray(node)) {
            return node.map(processChildren);
          } else if (node && node.props && node.props.children) {
            return {
              ...node,
              props: {
                ...node.props,
                children: processChildren(node.props.children)
              }
            };
          }
          return node;
        };
        setProcessedChildren(processChildren(children));
      });
    }
    if (window.rootStore) {
      init();
    } else {
      window.addEventListener("adu:storeReady", init);
    }
    return () => {
      window.removeEventListener("adu:storeReady", init);
      unsubscribe?.();
    };
  }, [children]);
  return <CodeGroup dropdown={dropdown}>{processedChildren}</CodeGroup>;
};

export const AuthCodeBlock = ({filename, icon, language, highlight, children}) => {
  const [displayText, setDisplayText] = useState(children);
  const [copyText, setCopyText] = useState(children);
  const wrapperRef = React.useRef(null);
  useEffect(() => {
    let unsubscribe = null;
    function init() {
      if (!window.autorun || !window.rootStore) {
        return;
      }
      unsubscribe = window.autorun(() => {
        let processedChildrenForDisplay = children;
        let processedChildrenForCopy = children;
        for (const [key, value] of window.rootStore.variableStore.values.entries()) {
          const escapedKey = key.replaceAll(/[.*+?^${}()|[\]\\]/g, (String.raw)`\$&`);
          let displayValue = value;
          if (key === "{yourClientSecret}" && value !== "{yourClientSecret}") {
            displayValue = value.substring(0, 3) + "*****MASKED*****";
          }
          processedChildrenForDisplay = processedChildrenForDisplay.replaceAll(new RegExp(escapedKey, "g"), displayValue);
          processedChildrenForCopy = processedChildrenForCopy.replaceAll(new RegExp(escapedKey, "g"), value);
        }
        setDisplayText(processedChildrenForDisplay);
        setCopyText(processedChildrenForCopy);
      });
    }
    if (window.rootStore) {
      init();
    } else {
      window.addEventListener("adu:storeReady", init);
    }
    return () => {
      window.removeEventListener("adu:storeReady", init);
      unsubscribe?.();
    };
  }, [children]);
  useEffect(() => {
    if (!wrapperRef.current) return;
    const originalWriteText = navigator.clipboard.writeText.bind(navigator.clipboard);
    let isOverriding = false;
    const handleClick = e => {
      const button = e.target.closest('[data-testid="copy-code-button"]');
      if (!button || !wrapperRef.current.contains(button)) return;
      isOverriding = true;
      navigator.clipboard.writeText = text => {
        if (isOverriding) {
          isOverriding = false;
          navigator.clipboard.writeText = originalWriteText;
          return originalWriteText(copyText);
        }
        return originalWriteText(text);
      };
      setTimeout(() => {
        if (isOverriding) {
          isOverriding = false;
          navigator.clipboard.writeText = originalWriteText;
        }
      }, 100);
    };
    const wrapper = wrapperRef.current;
    wrapper.addEventListener('click', handleClick, true);
    return () => {
      wrapper.removeEventListener('click', handleClick, true);
      if (navigator.clipboard.writeText !== originalWriteText) {
        navigator.clipboard.writeText = originalWriteText;
      }
    };
  }, [copyText]);
  return <div ref={wrapperRef}>
      <CodeBlock filename={filename} icon={icon} language={language} lines highlight={highlight}>
        {displayText}
      </CodeBlock>
    </div>;
};

<Card title="Before you start">
  * Configure a [machine-to-machine (M2M) application](/docs/get-started/auth0-overview/create-applications/machine-to-machine-apps), and [grant it access to the Auth0 Management API](/docs/secure/tokens/access-tokens/management-api-access-tokens/get-management-api-access-tokens-for-production) with the following scopes:

    * `create:authentication_methods`
    * `read:authentication_methods`
    * `update:authentication_methods`
    * `delete:authentication_methods`
</Card>

The [Auth0 Management API](https://auth0.com/docs/api/management/v2) provides several endpoints you can use to manage your users' <Tooltip tip="Multi-factor authentication (MFA): User authentication process that uses a factor in addition to username and password such as a code via SMS." cta="View Glossary" href="/docs/glossary?term=MFA">MFA</Tooltip> authentication methods.

This method relies on authenticating using a confidential application. To learn more about confidential vs. public applications, read [Confidential and Public Applications](/docs/get-started/applications/confidential-and-public-applications).

## Get all authentication methods

Use the [Gets a list of authentication methods](https://auth0.com/docs/api/management/v2#!/Users/get_authentication_methods) endpoint to get a list of all of the authentication methods a user has either fully or partially enrolled.

This endpoint requires the scope: `read:authentication_methods`.

### Examples

The following request returns a list of all authentication methods for a specified user.

<AuthCodeGroup>
  ```bash cURL lines theme={null}
  curl --request GET \
    --url https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods \
    --header 'authorization: Bearer {yourMgmtApiAccessToken}'
  ```

  ```csharp C# lines theme={null}
  var client = new RestClient("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods");
  var request = new RestRequest(Method.GET);
  request.AddHeader("authorization", "Bearer {yourMgmtApiAccessToken}");
  IRestResponse response = client.Execute(request);
  ```

  ```go Go lines theme={null}
  package main

  import (
  	"fmt"
  	"net/http"
  	"io/ioutil"
  )

  func main() {

  	url := "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods"

  	req, _ := http.NewRequest("GET", url, nil)

  	req.Header.Add("authorization", "Bearer {yourMgmtApiAccessToken}")

  	res, _ := http.DefaultClient.Do(req)

  	defer res.Body.Close()
  	body, _ := ioutil.ReadAll(res.Body)

  	fmt.Println(res)
  	fmt.Println(string(body))

  }
  ```

  ```java Java lines theme={null}
  HttpResponse<String> response = Unirest.get("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods")
    .header("authorization", "Bearer {yourMgmtApiAccessToken}")
    .asString();
  ```

  ```javascript Node.JS lines theme={null}
  var axios = require("axios").default;

  var options = {
    method: 'GET',
    url: 'https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods',
    headers: {authorization: 'Bearer {yourMgmtApiAccessToken}'}
  };

  axios.request(options).then(function (response) {
    console.log(response.data);
  }).catch(function (error) {
    console.error(error);
  });
  ```

  ```php PHP lines theme={null}
  $curl = curl_init();

  curl_setopt_array($curl, [
    CURLOPT_URL => "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_ENCODING => "",
    CURLOPT_MAXREDIRS => 10,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
    CURLOPT_CUSTOMREQUEST => "GET",
    CURLOPT_HTTPHEADER => [
      "authorization: Bearer {yourMgmtApiAccessToken}"
    ],
  ]);

  $response = curl_exec($curl);
  $err = curl_error($curl);

  curl_close($curl);

  if ($err) {
    echo "cURL Error #:" . $err;
  } else {
    echo $response;
  }
  ```

  ```python Python lines theme={null}
  import http.client

  conn = http.client.HTTPSConnection("")

  headers = { 'authorization': "Bearer {yourMgmtApiAccessToken}" }

  conn.request("GET", "%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods", headers=headers)

  res = conn.getresponse()
  data = res.read()

  print(data.decode("utf-8"))
  ```

  ```ruby Ruby lines theme={null}
  require 'uri'
  require 'net/http'
  require 'openssl'

  url = URI("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods")

  http = Net::HTTP.new(url.host, url.port)
  http.use_ssl = true
  http.verify_mode = OpenSSL::SSL::VERIFY_NONE

  request = Net::HTTP::Get.new(url)
  request["authorization"] = 'Bearer {yourMgmtApiAccessToken}'

  response = http.request(request)
  puts response.read_body
  ```
</AuthCodeGroup>

### Responses

For each valid request, the <Tooltip tip="Management API: A product to allow customers to perform administrative tasks." cta="View Glossary" href="/docs/glossary?term=Management+API">Management API</Tooltip> will return a response in the JSON format.

```json lines theme={null}
[
  {
    "id": "totp|dev_XXXXXXXXXXXXXXXX",
    "type": "totp",
    "confirmed": true,
    "created_at": "2021-09-23T22:57:30.206Z",
    "last_auth_at": "2021-09-23T22:57:51.652Z"
  }
]
```

## Get a single authentication method

Use the [Gets an authentication method by ID](https://auth0.com/docs/api/management/v2#!/Users/get_authentication_methods_by_authentication_method_id) endpoint to get a single authentication method for a user specified by the authentication method's ID.

This endpoint requires the scope: `read:authentication_methods`.

### Examples

The following request returns a single authentication method for a user based on the specified authentication method's ID.

<AuthCodeGroup>
  ```bash cURL lines theme={null}
  curl --request GET \
    --url https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D \
    --header 'authorization: Bearer {yourMgmtApiAccessToken}'
  ```

  ```csharp C# lines theme={null}
  var client = new RestClient("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D");
  var request = new RestRequest(Method.GET);
  request.AddHeader("authorization", "Bearer {yourMgmtApiAccessToken}");
  IRestResponse response = client.Execute(request);
  ```

  ```go Go lines theme={null}
  package main

  import (
  	"fmt"
  	"net/http"
  	"io/ioutil"
  )

  func main() {

  	url := "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D"

  	req, _ := http.NewRequest("GET", url, nil)

  	req.Header.Add("authorization", "Bearer {yourMgmtApiAccessToken}")

  	res, _ := http.DefaultClient.Do(req)

  	defer res.Body.Close()
  	body, _ := ioutil.ReadAll(res.Body)

  	fmt.Println(res)
  	fmt.Println(string(body))

  }
  ```

  ```java Java lines theme={null}
  HttpResponse<String> response = Unirest.get("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D")
    .header("authorization", "Bearer {yourMgmtApiAccessToken}")
    .asString();
  ```

  ```javascript Node.JS lines theme={null}
  var axios = require("axios").default;

  var options = {
    method: 'GET',
    url: 'https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D',
    headers: {authorization: 'Bearer {yourMgmtApiAccessToken}'}
  };

  axios.request(options).then(function (response) {
    console.log(response.data);
  }).catch(function (error) {
    console.error(error);
  });
  ```

  ```php PHP lines theme={null}
  $curl = curl_init();

  curl_setopt_array($curl, [
    CURLOPT_URL => "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_ENCODING => "",
    CURLOPT_MAXREDIRS => 10,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
    CURLOPT_CUSTOMREQUEST => "GET",
    CURLOPT_HTTPHEADER => [
      "authorization: Bearer {yourMgmtApiAccessToken}"
    ],
  ]);

  $response = curl_exec($curl);
  $err = curl_error($curl);

  curl_close($curl);

  if ($err) {
    echo "cURL Error #:" . $err;
  } else {
    echo $response;
  }
  ```

  ```python Python lines theme={null}
  import http.client

  conn = http.client.HTTPSConnection("")

  headers = { 'authorization': "Bearer {yourMgmtApiAccessToken}" }

  conn.request("GET", "%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D", headers=headers)

  res = conn.getresponse()
  data = res.read()

  print(data.decode("utf-8"))
  ```

  ```ruby Ruby lines theme={null}
  require 'uri'
  require 'net/http'
  require 'openssl'

  url = URI("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D")

  http = Net::HTTP.new(url.host, url.port)
  http.use_ssl = true
  http.verify_mode = OpenSSL::SSL::VERIFY_NONE

  request = Net::HTTP::Get.new(url)
  request["authorization"] = 'Bearer {yourMgmtApiAccessToken}'

  response = http.request(request)
  puts response.read_body
  ```
</AuthCodeGroup>

### Responses

For each valid request, the Management API will return a response in the JSON format.

```json lines theme={null}
{
    "id": "totp|dev_XXXXXXXXXXXXXXXX",
    "type": "totp",
    "confirmed": true,
    "created_at": "2021-09-23T22:57:30.206Z",
    "last_auth_at": "2021-09-23T22:57:51.652Z"
}
```

## Create an authentication method

Use the [Creates an authentication method for a given user](https://auth0.com/docs/api/management/v2#!/Users/post_authentication_methods) endpoint to create an authentication method for a user, including SMS, email, one-time password (OTP), or WebAuthn with security keys. To learn more about available MFA authentication factors, read [Multi-Factor Authentication Factors](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors).

This endpoint requires the scope: `create:authentication_methods`.

<Warning>
  Authentication methods created through this endpoint will be confirmed automatically and available immediately. Verify with the user that the authentication method is configured correctly and is still valid.
</Warning>

### SMS

Send users an OTP over SMS which the user is then prompted to enter before they can finish authenticating.

#### Examples

The following request creates a SMS authentication method for a user.

<AuthCodeGroup>
  ```bash cURL lines theme={null}
  curl --request POST \
    --url https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods \
    --header 'authorization: Bearer {yourMgmtApiAccessToken}' \
    --data '{ "type": "phone", "name": "SMS", "phone_number": "+00000000000" }'
  ```

  ```csharp C# lines theme={null}
  var client = new RestClient("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods");
  var request = new RestRequest(Method.POST);
  request.AddHeader("authorization", "Bearer {yourMgmtApiAccessToken}");
  request.AddParameter("undefined", "{ \"type\": \"phone\", \"name\": \"SMS\", \"phone_number\": \"+00000000000\" }", ParameterType.RequestBody);
  IRestResponse response = client.Execute(request);
  ```

  ```go Go lines expandable theme={null}
  package main

  import (
  	"fmt"
  	"strings"
  	"net/http"
  	"io/ioutil"
  )

  func main() {

  	url := "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods"

  	payload := strings.NewReader("{ \"type\": \"phone\", \"name\": \"SMS\", \"phone_number\": \"+00000000000\" }")

  	req, _ := http.NewRequest("POST", url, payload)

  	req.Header.Add("authorization", "Bearer {yourMgmtApiAccessToken}")

  	res, _ := http.DefaultClient.Do(req)

  	defer res.Body.Close()
  	body, _ := ioutil.ReadAll(res.Body)

  	fmt.Println(res)
  	fmt.Println(string(body))

  }
  ```

  ```java Java lines theme={null}
  HttpResponse<String> response = Unirest.post("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods")
    .header("authorization", "Bearer {yourMgmtApiAccessToken}")
    .body("{ \"type\": \"phone\", \"name\": \"SMS\", \"phone_number\": \"+00000000000\" }")
    .asString();
  ```

  ```javascript Node.JS lines theme={null}
  var axios = require("axios").default;

  var options = {
    method: 'POST',
    url: 'https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods',
    headers: {authorization: 'Bearer {yourMgmtApiAccessToken}'},
    data: {type: 'phone', name: 'SMS', phone_number: '+00000000000'}
  };

  axios.request(options).then(function (response) {
    console.log(response.data);
  }).catch(function (error) {
    console.error(error);
  });
  ```

  ```php PHP lines expandable theme={null}
  $curl = curl_init();

  curl_setopt_array($curl, [
    CURLOPT_URL => "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_ENCODING => "",
    CURLOPT_MAXREDIRS => 10,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_POSTFIELDS => "{ \"type\": \"phone\", \"name\": \"SMS\", \"phone_number\": \"+00000000000\" }",
    CURLOPT_HTTPHEADER => [
      "authorization: Bearer {yourMgmtApiAccessToken}"
    ],
  ]);

  $response = curl_exec($curl);
  $err = curl_error($curl);

  curl_close($curl);

  if ($err) {
    echo "cURL Error #:" . $err;
  } else {
    echo $response;
  }
  ```

  ```python Python lines theme={null}
  import http.client

  conn = http.client.HTTPSConnection("")

  payload = "{ \"type\": \"phone\", \"name\": \"SMS\", \"phone_number\": \"+00000000000\" }"

  headers = { 'authorization': "Bearer {yourMgmtApiAccessToken}" }

  conn.request("POST", "%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods", payload, headers)

  res = conn.getresponse()
  data = res.read()

  print(data.decode("utf-8"))
  ```

  ```ruby Ruby lines theme={null}
  require 'uri'
  require 'net/http'
  require 'openssl'

  url = URI("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods")

  http = Net::HTTP.new(url.host, url.port)
  http.use_ssl = true
  http.verify_mode = OpenSSL::SSL::VERIFY_NONE

  request = Net::HTTP::Post.new(url)
  request["authorization"] = 'Bearer {yourMgmtApiAccessToken}'
  request.body = "{ \"type\": \"phone\", \"name\": \"SMS\", \"phone_number\": \"+00000000000\" }"

  response = http.request(request)
  puts response.read_body
  ```
</AuthCodeGroup>

#### Responses

For each valid request, the Management API will return a response in the JSON format.

```json lines theme={null}
{
    "type": "phone",
    "name": "SMS",
    "created_at": "2023-01-01T00:00:00.000Z",
    "phone_number": "user@example.com",
    "id": "phone|dev_XXXXXXXXXXXXXXXX"
}
```

### Email

Send users an OTP over email which the user is then prompted to enter before they can finish authenticating. The email factor is only supported when a user has no other factors available.

#### Examples

The following request creates an email authentication method for a user.

<AuthCodeGroup>
  ```bash cURL lines theme={null}
  curl --request POST \
    --url https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods \
    --header 'authorization: Bearer {yourMgmtApiAccessToken}' \
    --data '{ "type": "email", "name": "Email Factor", "email": "user@example.com" }'
  ```

  ```csharp C# lines theme={null}
  var client = new RestClient("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods");
  var request = new RestRequest(Method.POST);
  request.AddHeader("authorization", "Bearer {yourMgmtApiAccessToken}");
  request.AddParameter("undefined", "{ \"type\": \"email\", \"name\": \"Email Factor\", \"email\": \"user@example.com\" }", ParameterType.RequestBody);
  IRestResponse response = client.Execute(request);
  ```

  ```go Go lines expandable theme={null}
  package main

  import (
  	"fmt"
  	"strings"
  	"net/http"
  	"io/ioutil"
  )

  func main() {

  	url := "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods"

  	payload := strings.NewReader("{ \"type\": \"email\", \"name\": \"Email Factor\", \"email\": \"user@example.com\" }")

  	req, _ := http.NewRequest("POST", url, payload)

  	req.Header.Add("authorization", "Bearer {yourMgmtApiAccessToken}")

  	res, _ := http.DefaultClient.Do(req)

  	defer res.Body.Close()
  	body, _ := ioutil.ReadAll(res.Body)

  	fmt.Println(res)
  	fmt.Println(string(body))

  }
  ```

  ```java Java lines theme={null}
  HttpResponse<String> response = Unirest.post("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods")
    .header("authorization", "Bearer {yourMgmtApiAccessToken}")
    .body("{ \"type\": \"email\", \"name\": \"Email Factor\", \"email\": \"user@example.com\" }")
    .asString();
  ```

  ```javascript Node.JS lines theme={null}
  var axios = require("axios").default;

  var options = {
    method: 'POST',
    url: 'https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods',
    headers: {authorization: 'Bearer {yourMgmtApiAccessToken}'},
    data: {type: 'email', name: 'Email Factor', email: 'user@example.com'}
  };

  axios.request(options).then(function (response) {
    console.log(response.data);
  }).catch(function (error) {
    console.error(error);
  });
  ```

  ```php PHP lines expandable theme={null}
  $curl = curl_init();

  curl_setopt_array($curl, [
    CURLOPT_URL => "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_ENCODING => "",
    CURLOPT_MAXREDIRS => 10,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_POSTFIELDS => "{ \"type\": \"email\", \"name\": \"Email Factor\", \"email\": \"user@example.com\" }",
    CURLOPT_HTTPHEADER => [
      "authorization: Bearer {yourMgmtApiAccessToken}"
    ],
  ]);

  $response = curl_exec($curl);
  $err = curl_error($curl);

  curl_close($curl);

  if ($err) {
    echo "cURL Error #:" . $err;
  } else {
    echo $response;
  }
  ```

  ```python Python lines theme={null}
  import http.client

  conn = http.client.HTTPSConnection("")

  payload = "{ \"type\": \"email\", \"name\": \"Email Factor\", \"email\": \"user@example.com\" }"

  headers = { 'authorization': "Bearer {yourMgmtApiAccessToken}" }

  conn.request("POST", "%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods", payload, headers)

  res = conn.getresponse()
  data = res.read()

  print(data.decode("utf-8"))
  ```

  ```ruby Ruby lines theme={null}
  require 'uri'
  require 'net/http'
  require 'openssl'

  url = URI("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods")

  http = Net::HTTP.new(url.host, url.port)
  http.use_ssl = true
  http.verify_mode = OpenSSL::SSL::VERIFY_NONE

  request = Net::HTTP::Post.new(url)
  request["authorization"] = 'Bearer {yourMgmtApiAccessToken}'
  request.body = "{ \"type\": \"email\", \"name\": \"Email Factor\", \"email\": \"user@example.com\" }"

  response = http.request(request)
  puts response.read_body
  ```
</AuthCodeGroup>

#### Responses

For each valid request, the Management API will return a response in the JSON format.

```json lines theme={null}
{
    "type": "email",
    "name": "Email Factor",
    "created_at": "2023-01-01T00:00:00.000Z",
    "email": "user@example.com",
    "id": "email|dev_XXXXXXXXXXXXXXXX"
}
```

### One-time passwords (OTP)

Enable users to use an authenticator application, such as Google Authenticator, on their personal device to generate an OTP that changes periodically, which the user is prompted to enter before they finish authenticating.

#### Examples

The following request creates an OTP authentication method for a user.

<AuthCodeGroup>
  ```bash cURL theme={null}
  curl --request POST \
    --url https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods \
    --header 'authorization: Bearer {yourMgmtApiAccessToken}' \
    --data '{ "type": "totp", "name": "OTP Application", "totp_secret": "{yourSecret}" }'
  ```

  ```csharp C# theme={null}
  var client = new RestClient("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods");
  var request = new RestRequest(Method.POST);
  request.AddHeader("authorization", "Bearer {yourMgmtApiAccessToken}");
  request.AddParameter("undefined", "{ "type": "totp", "name": "OTP Application", "totp_secret": "{yourSecret}" }", ParameterType.RequestBody);
  IRestResponse response = client.Execute(request);
  ```

  ```go Go theme={null}
  package main

  import (
  	"fmt"
  	"strings"
  	"net/http"
  	"io/ioutil"
  )

  func main() {

  	url := "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods"

  	payload := strings.NewReader("{ "type": "totp", "name": "OTP Application", "totp_secret": "{yourSecret}" }")

  	req, _ := http.NewRequest("POST", url, payload)

  	req.Header.Add("authorization", "Bearer {yourMgmtApiAccessToken}")

  	res, _ := http.DefaultClient.Do(req)

  	defer res.Body.Close()
  	body, _ := ioutil.ReadAll(res.Body)

  	fmt.Println(res)
  	fmt.Println(string(body))

  }
  ```

  ```java Java theme={null}
  HttpResponse<String> response = Unirest.post("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods")
    .header("authorization", "Bearer {yourMgmtApiAccessToken}")
    .body("{ "type": "totp", "name": "OTP Application", "totp_secret": "{yourSecret}" }")
    .asString();
  ```

  ```javascript Node.JS theme={null}
  var axios = require("axios").default;

  var options = {
    method: 'POST',
    url: 'https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods',
    headers: {authorization: 'Bearer {yourMgmtApiAccessToken}'},
    data: {type: 'totp', name: 'OTP Application', totp_secret: '{yourSecret}'}
  };

  axios.request(options).then(function (response) {
    console.log(response.data);
  }).catch(function (error) {
    console.error(error);
  });
  ```

  ```php PHP theme={null}
  $curl = curl_init();

  curl_setopt_array($curl, [
    CURLOPT_URL => "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_ENCODING => "",
    CURLOPT_MAXREDIRS => 10,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_POSTFIELDS => "{ "type": "totp", "name": "OTP Application", "totp_secret": "{yourSecret}" }",
    CURLOPT_HTTPHEADER => [
      "authorization: Bearer {yourMgmtApiAccessToken}"
    ],
  ]);

  $response = curl_exec($curl);
  $err = curl_error($curl);

  curl_close($curl);

  if ($err) {
    echo "cURL Error #:" . $err;
  } else {
    echo $response;
  }
  ```

  ```python Python theme={null}
  import http.client

  conn = http.client.HTTPSConnection("")

  payload = "{ "type": "totp", "name": "OTP Application", "totp_secret": "{yourSecret}" }"

  headers = { 'authorization': "Bearer {yourMgmtApiAccessToken}" }

  conn.request("POST", "%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods", payload, headers)

  res = conn.getresponse()
  data = res.read()

  print(data.decode("utf-8"))
  ```

  ```ruby Ruby theme={null}
  require 'uri'
  require 'net/http'
  require 'openssl'

  url = URI("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods")

  http = Net::HTTP.new(url.host, url.port)
  http.use_ssl = true
  http.verify_mode = OpenSSL::SSL::VERIFY_NONE

  request = Net::HTTP::Post.new(url)
  request["authorization"] = 'Bearer {yourMgmtApiAccessToken}'
  request.body = "{ "type": "totp", "name": "OTP Application", "totp_secret": "{yourSecret}" }"

  response = http.request(request)
  puts response.read_body
  ```
</AuthCodeGroup>

#### Responses

For each valid request, the Management API will return a response in the JSON format.

```json lines theme={null}
{
    "type": "totp",
    "name": "OTP Application",
    "created_at": "2023-01-01T00:00:00.000Z",
    "email": "user@example.com",
    "id": "totp|dev_XXXXXXXXXXXXXXXX"
}
```

### WebAuthn with security keys

Enable users to use FIDO-compliant security keys (for example, [Yubikey](https://www.yubico.com/) or [Google Titan](https://cloud.google.com/titan-security-key)) to perform multi-factor authentication.

#### Examples

The following request creates a WebAuthn with security keys authentication method for a user.

<AuthCodeGroup>
  ```bash cURL theme={null}
  curl --request POST \
    --url https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods \
    --header 'authorization: Bearer {yourMgmtApiAccessToken}' \
    --data '{ "type": "webauthn_roaming", "name": "WebAuthn with security keys", "public_key": "{yourPublicKey}", "key_id": "{yourKeyId}", "relying_party_identifier": "{yourDomain}" }'
  ```

  ```csharp C# theme={null}
  var client = new RestClient("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods");
  var request = new RestRequest(Method.POST);
  request.AddHeader("authorization", "Bearer {yourMgmtApiAccessToken}");
  request.AddParameter("undefined", "{ "type": "webauthn_roaming", "name": "WebAuthn with security keys", "public_key": "{yourPublicKey}", "key_id": "{yourKeyId}", "relying_party_identifier": "{yourDomain}" }", ParameterType.RequestBody);
  IRestResponse response = client.Execute(request);
  ```

  ```go Go theme={null}
  package main

  import (
  	"fmt"
  	"strings"
  	"net/http"
  	"io/ioutil"
  )

  func main() {

  	url := "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods"

  	payload := strings.NewReader("{ "type": "webauthn_roaming", "name": "WebAuthn with security keys", "public_key": "{yourPublicKey}", "key_id": "{yourKeyId}", "relying_party_identifier": "{yourDomain}" }")

  	req, _ := http.NewRequest("POST", url, payload)

  	req.Header.Add("authorization", "Bearer {yourMgmtApiAccessToken}")

  	res, _ := http.DefaultClient.Do(req)

  	defer res.Body.Close()
  	body, _ := ioutil.ReadAll(res.Body)

  	fmt.Println(res)
  	fmt.Println(string(body))

  }
  ```

  ```java Java theme={null}
  HttpResponse<String> response = Unirest.post("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods")
    .header("authorization", "Bearer {yourMgmtApiAccessToken}")
    .body("{ "type": "webauthn_roaming", "name": "WebAuthn with security keys", "public_key": "{yourPublicKey}", "key_id": "{yourKeyId}", "relying_party_identifier": "{yourDomain}" }")
    .asString();
  ```

  ```javascript Node.JS theme={null}
  var axios = require("axios").default;

  var options = {
    method: 'POST',
    url: 'https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods',
    headers: {authorization: 'Bearer {yourMgmtApiAccessToken}'},
    data: {
      type: 'webauthn_roaming',
      name: 'WebAuthn with security keys',
      public_key: '{yourPublicKey}',
      key_id: '{yourKeyId}',
      relying_party_identifier: '{yourDomain}'
    }
  };

  axios.request(options).then(function (response) {
    console.log(response.data);
  }).catch(function (error) {
    console.error(error);
  });
  ```

  ```php PHP theme={null}
  $curl = curl_init();

  curl_setopt_array($curl, [
    CURLOPT_URL => "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_ENCODING => "",
    CURLOPT_MAXREDIRS => 10,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_POSTFIELDS => "{ "type": "webauthn_roaming", "name": "WebAuthn with security keys", "public_key": "{yourPublicKey}", "key_id": "{yourKeyId}", "relying_party_identifier": "{yourDomain}" }",
    CURLOPT_HTTPHEADER => [
      "authorization: Bearer {yourMgmtApiAccessToken}"
    ],
  ]);

  $response = curl_exec($curl);
  $err = curl_error($curl);

  curl_close($curl);

  if ($err) {
    echo "cURL Error #:" . $err;
  } else {
    echo $response;
  }
  ```

  ```python Python theme={null}
  import http.client

  conn = http.client.HTTPSConnection("")

  payload = "{ "type": "webauthn_roaming", "name": "WebAuthn with security keys", "public_key": "{yourPublicKey}", "key_id": "{yourKeyId}", "relying_party_identifier": "{yourDomain}" }"

  headers = { 'authorization': "Bearer {yourMgmtApiAccessToken}" }

  conn.request("POST", "%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods", payload, headers)

  res = conn.getresponse()
  data = res.read()

  print(data.decode("utf-8"))
  ```

  ```ruby Ruby theme={null}
  require 'uri'
  require 'net/http'
  require 'openssl'

  url = URI("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods")

  http = Net::HTTP.new(url.host, url.port)
  http.use_ssl = true
  http.verify_mode = OpenSSL::SSL::VERIFY_NONE

  request = Net::HTTP::Post.new(url)
  request["authorization"] = 'Bearer {yourMgmtApiAccessToken}'
  request.body = "{ "type": "webauthn_roaming", "name": "WebAuthn with security keys", "public_key": "{yourPublicKey}", "key_id": "{yourKeyId}", "relying_party_identifier": "{yourDomain}" }"

  response = http.request(request)
  puts response.read_body
  ```
</AuthCodeGroup>

#### Responses

For each valid request, the Management API will return a response in the JSON format.

```json lines theme={null}
{
    "type": "webauthn-roaming",
    "name": "WebAuthn with security keys",
    "relyingPartyIdentifier": "example-tenant.auth0.com",
    "keyId": "X9FrwMfmzj...",
    "publicKey": "bXktcHVibGljLWtle...",
    "created_at": "2023-03-09T17:33:47.545Z",
    "id": "webauthn-roaming|dev_XXXXXXXXXXXXXXXX"
}
```

## Replace all authentication methods

Use the [Updates all authentication methods by replacing them with the given ones](https://auth0.com/docs/api/management/v2#!/Users/put_authentication_methods) endpoint to replace all existing authentication methods with those provided.

This endpoint requires the scope: `update:authentication_methods`.

### Examples

The following request replaces all existing authentication methods for a user.

<AuthCodeGroup>
  ```bash cURL lines theme={null}
  curl --request PUT \
    --url https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods \
    --header 'authorization: Bearer {yourMgmtApiAccessToken}' \
    --data '[{ "type": "phone", "preferred_authentication_method": "sms", "phone_number": "+00000000000", "name": "SMS" }]'
  ```

  ```csharp C# lines theme={null}
  var client = new RestClient("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods");
  var request = new RestRequest(Method.PUT);
  request.AddHeader("authorization", "Bearer {yourMgmtApiAccessToken}");
  request.AddParameter("undefined", "[{ \"type\": \"phone\", \"preferred_authentication_method\": \"sms\", \"phone_number\": \"+00000000000\", \"name\": \"SMS\" }]", ParameterType.RequestBody);
  IRestResponse response = client.Execute(request);
  ```

  ```go Go lines expandable theme={null}
  package main

  import (
  	"fmt"
  	"strings"
  	"net/http"
  	"io/ioutil"
  )

  func main() {

  	url := "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods"

  	payload := strings.NewReader("[{ \"type\": \"phone\", \"preferred_authentication_method\": \"sms\", \"phone_number\": \"+00000000000\", \"name\": \"SMS\" }]")

  	req, _ := http.NewRequest("PUT", url, payload)

  	req.Header.Add("authorization", "Bearer {yourMgmtApiAccessToken}")

  	res, _ := http.DefaultClient.Do(req)

  	defer res.Body.Close()
  	body, _ := ioutil.ReadAll(res.Body)

  	fmt.Println(res)
  	fmt.Println(string(body))

  }
  ```

  ```java Java lines theme={null}
  HttpResponse<String> response = Unirest.put("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods")
    .header("authorization", "Bearer {yourMgmtApiAccessToken}")
    .body("[{ \"type\": \"phone\", \"preferred_authentication_method\": \"sms\", \"phone_number\": \"+00000000000\", \"name\": \"SMS\" }]")
    .asString();
  ```

  ```javascript Node.JS lines theme={null}
  var axios = require("axios").default;

  var options = {
    method: 'PUT',
    url: 'https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods',
    headers: {authorization: 'Bearer {yourMgmtApiAccessToken}'},
    data: [
      {
        type: 'phone',
        preferred_authentication_method: 'sms',
        phone_number: '+00000000000',
        name: 'SMS'
      }
    ]
  };

  axios.request(options).then(function (response) {
    console.log(response.data);
  }).catch(function (error) {
    console.error(error);
  });
  ```

  ```php PHP lines expandable theme={null}
  $curl = curl_init();

  curl_setopt_array($curl, [
    CURLOPT_URL => "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_ENCODING => "",
    CURLOPT_MAXREDIRS => 10,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
    CURLOPT_CUSTOMREQUEST => "PUT",
    CURLOPT_POSTFIELDS => "[{ \"type\": \"phone\", \"preferred_authentication_method\": \"sms\", \"phone_number\": \"+00000000000\", \"name\": \"SMS\" }]",
    CURLOPT_HTTPHEADER => [
      "authorization: Bearer {yourMgmtApiAccessToken}"
    ],
  ]);

  $response = curl_exec($curl);
  $err = curl_error($curl);

  curl_close($curl);

  if ($err) {
    echo "cURL Error #:" . $err;
  } else {
    echo $response;
  }
  ```

  ```python Python lines theme={null}
  import http.client

  conn = http.client.HTTPSConnection("")

  payload = "[{ \"type\": \"phone\", \"preferred_authentication_method\": \"sms\", \"phone_number\": \"+00000000000\", \"name\": \"SMS\" }]"

  headers = { 'authorization': "Bearer {yourMgmtApiAccessToken}" }

  conn.request("PUT", "%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods", payload, headers)

  res = conn.getresponse()
  data = res.read()

  print(data.decode("utf-8"))
  ```

  ```ruby Ruby lines theme={null}
  require 'uri'
  require 'net/http'
  require 'openssl'

  url = URI("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods")

  http = Net::HTTP.new(url.host, url.port)
  http.use_ssl = true
  http.verify_mode = OpenSSL::SSL::VERIFY_NONE

  request = Net::HTTP::Put.new(url)
  request["authorization"] = 'Bearer {yourMgmtApiAccessToken}'
  request.body = "[{ \"type\": \"phone\", \"preferred_authentication_method\": \"sms\", \"phone_number\": \"+00000000000\", \"name\": \"SMS\" }]"

  response = http.request(request)
  puts response.read_body
  ```
</AuthCodeGroup>

### Responses

For each valid request, the Management API will return a response in the JSON format.

```json lines theme={null}
[
  {
    "id": "phone|dev_XXXXXXXXXXXXXXXX",
    "type": "phone",
    "name": "SMS",
    "phone_number": "+00000000000",
    "created_at": "2023-03-09T17:53:23.647Z",
    "preferred_authentication_method": "sms",
    "authentication_methods": [
      {
        "id": "sms|dev_XXXXXXXXXXXXXXXX",
        "type": "sms"
      }
    ]
  }
]
```

## Update a single authentication method

Use the [Updates an authentication method](https://auth0.com/docs/api/management/v2#!/Users/patch_authentication_methods_by_authentication_method_id) endpoint to update a single authentication method for a user.

This endpoint requires the scope: `update:authentication_methods`.

### Examples

The following request updates a single authentication method for a user based on the specific authentication method's ID.

<AuthCodeGroup>
  ```bash cURL lines theme={null}
  curl --request PATCH \
    --url https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D \
    --header 'authorization: Bearer {yourMgmtApiAccessToken}' \
    --data '{ "name": "Mobile SMS" }'
  ```

  ```csharp C# lines theme={null}
  var client = new RestClient("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D");
  var request = new RestRequest(Method.PATCH);
  request.AddHeader("authorization", "Bearer {yourMgmtApiAccessToken}");
  request.AddParameter("undefined", "{ \"name\": \"Mobile SMS\" }", ParameterType.RequestBody);
  IRestResponse response = client.Execute(request);
  ```

  ```go Go lines expandable theme={null}
  package main

  import (
  	"fmt"
  	"strings"
  	"net/http"
  	"io/ioutil"
  )

  func main() {

  	url := "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D"

  	payload := strings.NewReader("{ \"name\": \"Mobile SMS\" }")

  	req, _ := http.NewRequest("PATCH", url, payload)

  	req.Header.Add("authorization", "Bearer {yourMgmtApiAccessToken}")

  	res, _ := http.DefaultClient.Do(req)

  	defer res.Body.Close()
  	body, _ := ioutil.ReadAll(res.Body)

  	fmt.Println(res)
  	fmt.Println(string(body))

  }
  ```

  ```java Java lines theme={null}
  HttpResponse<String> response = Unirest.patch("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D")
    .header("authorization", "Bearer {yourMgmtApiAccessToken}")
    .body("{ \"name\": \"Mobile SMS\" }")
    .asString();
  ```

  ```javascript Node.JS lines theme={null}
  var axios = require("axios").default;

  var options = {
    method: 'PATCH',
    url: 'https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D',
    headers: {authorization: 'Bearer {yourMgmtApiAccessToken}'},
    data: {name: 'Mobile SMS'}
  };

  axios.request(options).then(function (response) {
    console.log(response.data);
  }).catch(function (error) {
    console.error(error);
  });
  ```

  ```php PHP lines expandable theme={null}
  $curl = curl_init();

  curl_setopt_array($curl, [
    CURLOPT_URL => "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_ENCODING => "",
    CURLOPT_MAXREDIRS => 10,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
    CURLOPT_CUSTOMREQUEST => "PATCH",
    CURLOPT_POSTFIELDS => "{ \"name\": \"Mobile SMS\" }",
    CURLOPT_HTTPHEADER => [
      "authorization: Bearer {yourMgmtApiAccessToken}"
    ],
  ]);

  $response = curl_exec($curl);
  $err = curl_error($curl);

  curl_close($curl);

  if ($err) {
    echo "cURL Error #:" . $err;
  } else {
    echo $response;
  }
  ```

  ```python Python lines theme={null}
  import http.client

  conn = http.client.HTTPSConnection("")

  payload = "{ \"name\": \"Mobile SMS\" }"

  headers = { 'authorization': "Bearer {yourMgmtApiAccessToken}" }

  conn.request("PATCH", "%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D", payload, headers)

  res = conn.getresponse()
  data = res.read()

  print(data.decode("utf-8"))
  ```

  ```ruby Ruby lines theme={null}
  require 'uri'
  require 'net/http'
  require 'openssl'

  url = URI("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D")

  http = Net::HTTP.new(url.host, url.port)
  http.use_ssl = true
  http.verify_mode = OpenSSL::SSL::VERIFY_NONE

  request = Net::HTTP::Patch.new(url)
  request["authorization"] = 'Bearer {yourMgmtApiAccessToken}'
  request.body = "{ \"name\": \"Mobile SMS\" }"

  response = http.request(request)
  puts response.read_body
  ```
</AuthCodeGroup>

### Responses

For each valid request, the Management API will return a response in the JSON format.

```json lines theme={null}
{
    "type": "phone",
    "name": "Mobile SMS",
    "created_at": "2023-01-12T00:03:52.855Z",
    "last_auth_at": "2023-01-12T00:04:05.157Z",
    "phone_number": "+00000000000",
    "preferred_authentication_method": "sms",
    "id": "phone|dev_XXXXXXXXXXXXXXXX",
    "authentication_methods": [
        {
            "id": "phone|dev_XXXXXXXXXXXXXXXX",
            "type": "phone"
        }
    ]
}
```

## Delete all authentication methods

Use the [Deletes all authentication methods for the given user](https://auth0.com/docs/api/management/v2#!/Users/delete_authentication_methods) endpoint to delete all authentication methods for a user.

This endpoint requires the scope: `delete:authentication_methods`.

### Examples

The following request deletes all authentication methods for a user.

<AuthCodeGroup>
  ```bash cURL lines theme={null}
  curl --request DELETE \
    --url https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods \
    --header 'authorization: Bearer {yourMgmtApiAccessToken}'
  ```

  ```csharp C# lines theme={null}
  var client = new RestClient("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods");
  var request = new RestRequest(Method.DELETE);
  request.AddHeader("authorization", "Bearer {yourMgmtApiAccessToken}");
  IRestResponse response = client.Execute(request);
  ```

  ```go Go lines theme={null}
  package main

  import (
  	"fmt"
  	"net/http"
  	"io/ioutil"
  )

  func main() {

  	url := "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods"

  	req, _ := http.NewRequest("DELETE", url, nil)

  	req.Header.Add("authorization", "Bearer {yourMgmtApiAccessToken}")

  	res, _ := http.DefaultClient.Do(req)

  	defer res.Body.Close()
  	body, _ := ioutil.ReadAll(res.Body)

  	fmt.Println(res)
  	fmt.Println(string(body))

  }
  ```

  ```java Java lines theme={null}
  HttpResponse<String> response = Unirest.delete("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods")
    .header("authorization", "Bearer {yourMgmtApiAccessToken}")
    .asString();
  ```

  ```javascript Node.JS lines theme={null}
  var axios = require("axios").default;

  var options = {
    method: 'DELETE',
    url: 'https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods',
    headers: {authorization: 'Bearer {yourMgmtApiAccessToken}'}
  };

  axios.request(options).then(function (response) {
    console.log(response.data);
  }).catch(function (error) {
    console.error(error);
  });
  ```

  ```php PHP lines theme={null}
  $curl = curl_init();

  curl_setopt_array($curl, [
    CURLOPT_URL => "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_ENCODING => "",
    CURLOPT_MAXREDIRS => 10,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
    CURLOPT_CUSTOMREQUEST => "DELETE",
    CURLOPT_HTTPHEADER => [
      "authorization: Bearer {yourMgmtApiAccessToken}"
    ],
  ]);

  $response = curl_exec($curl);
  $err = curl_error($curl);

  curl_close($curl);

  if ($err) {
    echo "cURL Error #:" . $err;
  } else {
    echo $response;
  }
  ```

  ```python Python lines theme={null}
  import http.client

  conn = http.client.HTTPSConnection("")

  headers = { 'authorization': "Bearer {yourMgmtApiAccessToken}" }

  conn.request("DELETE", "%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods", headers=headers)

  res = conn.getresponse()
  data = res.read()

  print(data.decode("utf-8"))
  ```

  ```ruby Ruby lines theme={null}
  require 'uri'
  require 'net/http'
  require 'openssl'

  url = URI("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods")

  http = Net::HTTP.new(url.host, url.port)
  http.use_ssl = true
  http.verify_mode = OpenSSL::SSL::VERIFY_NONE

  request = Net::HTTP::Delete.new(url)
  request["authorization"] = 'Bearer {yourMgmtApiAccessToken}'

  response = http.request(request)
  puts response.read_body
  ```
</AuthCodeGroup>

### Responses

For each valid request, the Management API will return a response with a `204` status code and empty body.

## Delete a single authentication method

Use the [Deletes an authentication method by ID](https://auth0.com/docs/api/management/v2#!/Users/delete_authentication_methods_by_authentication_method_id) endpoint to delete a single authentication method for a user.

### Examples

The following request deletes a single authentication method for a user based on the specified authentication method's ID.

<AuthCodeGroup>
  ```bash cURL lines theme={null}
  curl --request DELETE \
    --url https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D \
    --header 'authorization: Bearer {yourMgmtApiAccessToken}'
  ```

  ```csharp C# lines theme={null}
  var client = new RestClient("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D");
  var request = new RestRequest(Method.DELETE);
  request.AddHeader("authorization", "Bearer {yourMgmtApiAccessToken}");
  IRestResponse response = client.Execute(request);
  ```

  ```go Go lines theme={null}
  package main

  import (
  	"fmt"
  	"net/http"
  	"io/ioutil"
  )

  func main() {

  	url := "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D"

  	req, _ := http.NewRequest("DELETE", url, nil)

  	req.Header.Add("authorization", "Bearer {yourMgmtApiAccessToken}")

  	res, _ := http.DefaultClient.Do(req)

  	defer res.Body.Close()
  	body, _ := ioutil.ReadAll(res.Body)

  	fmt.Println(res)
  	fmt.Println(string(body))

  }
  ```

  ```java Java lines theme={null}
  HttpResponse<String> response = Unirest.delete("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D")
    .header("authorization", "Bearer {yourMgmtApiAccessToken}")
    .asString();
  ```

  ```javascript Node.JS lines theme={null}
  var axios = require("axios").default;

  var options = {
    method: 'DELETE',
    url: 'https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D',
    headers: {authorization: 'Bearer {yourMgmtApiAccessToken}'}
  };

  axios.request(options).then(function (response) {
    console.log(response.data);
  }).catch(function (error) {
    console.error(error);
  });
  ```

  ```php PHP lines theme={null}
  $curl = curl_init();

  curl_setopt_array($curl, [
    CURLOPT_URL => "https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_ENCODING => "",
    CURLOPT_MAXREDIRS => 10,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
    CURLOPT_CUSTOMREQUEST => "DELETE",
    CURLOPT_HTTPHEADER => [
      "authorization: Bearer {yourMgmtApiAccessToken}"
    ],
  ]);

  $response = curl_exec($curl);
  $err = curl_error($curl);

  curl_close($curl);

  if ($err) {
    echo "cURL Error #:" . $err;
  } else {
    echo $response;
  }
  ```

  ```python Python lines theme={null}
  import http.client

  conn = http.client.HTTPSConnection("")

  headers = { 'authorization': "Bearer {yourMgmtApiAccessToken}" }

  conn.request("DELETE", "%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D", headers=headers)

  res = conn.getresponse()
  data = res.read()

  print(data.decode("utf-8"))
  ```

  ```ruby Ruby lines theme={null}
  require 'uri'
  require 'net/http'
  require 'openssl'

  url = URI("https://%7ByourDomain%7D/api/v2/users/%7BuserId%7D/authentication-methods/%7BauthenticationMethodId%7D")

  http = Net::HTTP.new(url.host, url.port)
  http.use_ssl = true
  http.verify_mode = OpenSSL::SSL::VERIFY_NONE

  request = Net::HTTP::Delete.new(url)
  request["authorization"] = 'Bearer {yourMgmtApiAccessToken}'

  response = http.request(request)
  puts response.read_body
  ```
</AuthCodeGroup>

### Responses

For each valid request, the Management API will return a response with a `204` status code and empty body.

## Learn more

* [Multi-Factor Authentication Factors](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors)
* [Register Machine-to-Machine Applications](/docs/get-started/auth0-overview/create-applications/machine-to-machine-apps)
* [Get Management API Access Tokens for Production](/docs/secure/tokens/access-tokens/management-api-access-tokens/get-management-api-access-tokens-for-production)
* [Confidential and Public Applications](/docs/get-started/applications/confidential-and-public-applications)