Skip to main content
Version 0.3Draft

Multi-factor UX

Overview​

Multi-factor authentication (MFA) on LuxID is a user-side capability: users enrol one or more second factors in their LuxID Account (opens in a new tab) settings. As a partner application, you do not directly control which MFA method a user has enrolled; however, you can influence when MFA is required and what happens when it fails.

This page covers:

  • When LuxID prompts for a second factor
  • The UX of each supported method
  • Recovery paths and lockout prevention
  • Re-authentication patterns your application can trigger
  • User-facing guidance to link from your application

For the technical feature reference, see Multi-factor authentication.

When LuxID prompts for MFA​

LuxID may require a second factor in the following situations:

TriggerWho controls itDetail
Application requires a minimum Assurance LevelApplication (via acr_values parameter)If your application requests acr_values=urn:luxid:acr:level:substantial, users without an enrolled second factor are prompted to add one before proceeding
LuxID risk engine flags the sessionLuxID (automatic)LuxID may require a step-up challenge based on contextual security signals
User's account security settingsUserA user may configure their account to always require a second factor
Sensitive account actionLuxID (automatic)Changing email address, removing a second factor, or accessing account data export always requires re-authentication

Your application does not need to implement any MFA logic itself. The challenge, method selection, and verification all happen within Universal Login at https://login.luxid.lu.

Supported MFA methods and their UX​

One-time codes - SMS (OTP)​

What it is: a randomly generated numeric code delivered by SMS to the user's registered phone number. If SMS delivery fails, the user can request the code by voice call instead.

User experience:

  1. After entering their password, the user sees a screen: "We sent a code to +352 xxx xx xx 12. Enter it below."
  2. The user retrieves the code from the SMS and types it into the field.
  3. If the SMS has not arrived within 30 seconds, a "Resend code" link appears.
  4. If the user cannot receive SMS, a "Try a voice call instead" option is offered.
Important distinction

OTP codes (SMS/voice) are randomly generated per request and delivered out-of-band. They are distinct from TOTP codes generated by an authenticator app. Never conflate these two methods in user-facing copy.

For public user help, link to: https://www.luxid.lu/en/getting-started/setup-2fa (opens in a new tab)

Authenticator app - time-based OTP (TOTP)​

What it is: a 6-digit code generated by an authenticator app (Aegis, FreeOTP, Authy, Microsoft Authenticator, or any TOTP-compatible app) using a shared secret set up during enrolment.

User experience:

  1. After entering their password, the user sees: "Enter the 6-digit code from your authenticator app."
  2. The user opens their authenticator app, reads the current code (valid for 30 seconds), and types it in.
  3. A progress indicator may show the code's remaining validity window.

Key UX note: TOTP codes expire every 30 seconds. If a user sees the code change while typing, they should use the new code. LuxID accepts a small clock skew window to account for this.

Passkeys​

What it is: a WebAuthn/FIDO2 credential bound to a device. Authentication uses device biometrics (Face ID, Touch ID, fingerprint reader, Windows Hello) or a PIN.

User experience:

  1. After identifying their account (by email), the user may see a passkey prompt before the password field - passkeys can replace the password entirely if the user has enrolled one.
  2. The browser or OS presents the native biometric/PIN prompt.
  3. On success, the user is authenticated without typing any password.

For passkey-specific UX guidance, including device binding education and fallback flows, see Passwordless and passkey UX.

LuxTrust​

What it is: LuxTrust is a complementary identity and signature service operated separately from LuxID. The LuxTrust mobile app and smartcards can be used as a second factor on LuxID for users who have linked their LuxTrust certificate to their LuxID Account.

User experience:

  1. After entering their password, the user sees: "Confirm with your LuxTrust method."
  2. The user interacts with their LuxTrust mobile app or smartcard as they would for any LuxTrust transaction.
  3. On success, the MFA challenge is satisfied.
Important

LuxTrust is a second factor, not a substitute for the LuxID Account itself. A user without a LuxID Account cannot authenticate with LuxTrust alone. LuxTrust provides an independent identity verification pathway (see LuxID Verified) but the two functions are distinct.

Method selection UX​

When a user has enrolled multiple MFA methods, LuxID presents the most recently used or highest-assurance method by default. A "Use a different method" link allows the user to switch.

The method priority order (default, highest first) is:

  1. Passkey (if enrolled and supported by the current browser/device)
  2. LuxTrust
  3. TOTP (authenticator app)
  4. OTP (SMS/voice)

Users can change their preferred method in LuxID Account (opens in a new tab) > Security.

Recovery paths​

Users who cannot complete MFA (lost phone, broken device, SIM card issue) need a recovery path. LuxID provides the following:

SituationRecovery option
Lost phone with TOTP appIf the user enrolled a backup method (OTP SMS, LuxTrust), they can use it via "Use a different method"
Lost phone with SMS OTPIf the user enrolled a backup method (TOTP, LuxTrust), they can use it via "Use a different method"
No backup method enrolledThe user must contact LuxID for manual account recovery
Lost/damaged SIM cardUse a backup method, or contact LuxID

Guidance for Partner Applications​

If your application has a user-facing help centre, recommend that users:

caution

Do not attempt to build your own MFA recovery flow. All recovery is handled by LuxID support.

Avoiding lockouts: enrol a backup method​

The single most common cause of account lockout is having only one MFA method enrolled and then losing access to it.

When surfacing authentication-related messaging in your application (for example, a security settings page or a post-login nudge), encourage users to enrol a backup method:

"For uninterrupted access, we recommend setting up a second sign-in verification method in your LuxID Account. Visit LuxID Account (opens in a new tab) > Security to add a backup method."

Re-authentication patterns​

Your application can trigger re-authentication for sensitive actions - even when the user already has a valid LuxID session - using standard OIDC parameters.

Force password re-entry​

GET /mga/sps/oauth/oauth20/authorize?
  client_id=YOUR_CLIENT_ID
  &redirect_uri=https://yourapp.lu/callback
  &response_type=code
  &scope=openid email
  &prompt=login

The prompt=login parameter forces the user to re-enter their password even if a session cookie exists. Use this before irreversible actions such as account deletion or changing a payment method.

Time-based re-authentication​

GET /mga/sps/oauth/oauth20/authorize?
  client_id=YOUR_CLIENT_ID
  &redirect_uri=https://yourapp.lu/callback
  &response_type=code
  &scope=openid email
  &max_age=900

max_age=900 requires re-authentication if the user's last authentication was more than 900 seconds (15 minutes) ago. Use this for financial or healthcare applications with inactivity requirements.

Require a specific assurance level​

GET /mga/sps/oauth/oauth20/authorize?
  client_id=YOUR_CLIENT_ID
  &redirect_uri=https://yourapp.lu/callback
  &response_type=code
  &scope=openid email
  &acr_values=urn:luxid:acr:level:substantial

acr_values=urn:luxid:acr:level:substantial requires that the authentication meets the "Substantial" assurance level, which means a second factor must be used. If the user has not enrolled a second factor, they are prompted to do so before proceeding. The canonical form is urn:luxid:acr:level:low|substantial|high; the accepted request values are agreed per Partner during onboarding.

When referencing MFA in your application's own help content, link to the following public LuxID resources:

TopicURL
Setting up 2FA (English)https://www.luxid.lu/en/getting-started/setup-2fa (opens in a new tab)
Setting up 2FA (French)https://www.luxid.lu/fr/getting-started/setup-2fa (opens in a new tab)
Setting up 2FA (German)https://www.luxid.lu/de/getting-started/setup-2fa (opens in a new tab)
Setting up 2FA (Luxembourgish)https://www.luxid.lu/lb/getting-started/setup-2fa (opens in a new tab)

Match the URL language to your application's current interface language.

Updated 2026-07-02
On this page