```
Protects an API route by requiring authentication.
### mfa
```typescript theme={null}
get mfa(): ServerMfaClient
```
MFA API for server-side operations.
Provides access to MFA methods that require encrypted mfa\_token from MfaRequiredError:
* `getAuthenticators`: List enrolled MFA factors
* `challenge`: Initiate MFA challenge (OTP/OOB)
* `verify`: Complete MFA verification
## Example Usage
```typescript theme={null}
import { Auth0Client } from '@auth0/nextjs-auth0/server';
// Create an instance
export const auth0 = new Auth0Client({
domain: process.env.AUTH0_DOMAIN,
clientId: process.env.AUTH0_CLIENT_ID,
clientSecret: process.env.AUTH0_CLIENT_SECRET,
secret: process.env.AUTH0_SECRET,
appBaseUrl: process.env.APP_BASE_URL,
session: {
rolling: true,
absoluteDuration: 60 * 60 * 24 * 7, // 7 days
inactivityDuration: 60 * 60 * 24 // 1 day
}
});
// Use in middleware
export async function middleware(request: NextRequest) {
return await auth0.middleware(request);
}
// Get session in App Router
export default async function Page() {
const session = await auth0.getSession();
if (!session) {
return Not authenticated
;
}
return Welcome, {session.user.name}!
;
}
// Get access token in API route
export async function GET(request: NextRequest) {
try {
const { token } = await auth0.getAccessToken();
// Use the token to call an API
const response = await fetch('https://api.example.com/data', {
headers: {
Authorization: `Bearer ${token}`
}
});
return Response.json(await response.json());
} catch (error) {
if (error instanceof MfaRequiredError) {
// Handle MFA required scenario
return Response.json({ error: 'MFA required' }, { status: 401 });
}
throw error;
}
}
```