FerrisKeyMulti-Factor Authentication
Trident
Adds second-factor verification to the authentication chain. Supports TOTP, FIDO2 passkeys, magic links, and recovery codes, configurable per realm.
Covers
TOTPWebAuthnPasskeysMagic LinksRecovery CodesYubiKeyFace IDTouch IDRFC 6238FIDO2Key capabilities
What Trident does for you.
- 01
TOTP
Time-based one-time passwords compatible with Google Authenticator, Authy, 1Password, and any RFC 6238 app.
- 02
WebAuthn
FIDO2 passkeys: hardware keys (YubiKey), Touch ID, Face ID, Windows Hello, and synced passkeys.
- 03
Magic Links
Passwordless email login. A unique short-lived link lands in the inbox, and clicking it signs the user in.
- 04
Recovery Codes
One-time backup codes for account recovery when the primary MFA device is unavailable.
- 05
Required Actions
Enforce MFA enrollment on every new user, so it is mandatory rather than optional.
- 06
Temporary Tokens
Short-lived tokens issued during the MFA challenge. They cannot reach a protected resource.
How it works
From the first request to the result, in 4 steps.
- 1
Credentials validated
User submits their username and password. FerrisKey validates and checks for configured MFA credentials.
- 2
MFA challenge issued
If MFA is configured, a temporary token and challenge are returned. The client prompts for the second factor.
- 3
Second factor verified
The user submits the OTP, passkey assertion, or clicks the magic link. Trident validates the response.
- 4
Full tokens issued
On success, FerrisKey issues access, refresh, and ID tokens. The session is fully established.
Ready to use Trident?
Full reference, configuration options, and examples in the documentation.