Choose factors

Components turn choreography names into prompts and identity records. Auth Dance ships five component modules; custom components implement the same AuthDanceComponent interface.

Built-in components

Import	Role	Key configuration
components/email	Identification plus a linked delivery channel and OTP challenge	channel, challenge
components/otp	One-time code delivered over a configured channel	channel, optional digits and TTL
components/password	Password challenge	pepper, optional hasher
components/totp	Authenticator-app TOTP challenge	optional digits, period, algorithm, window
components/webauthn	WebAuthn identification and challenge	relying party; optional origins and ceremony settings

Email and OTP

Email creates three linked records: an identification, a channel, and an OTP challenge. Register the challenge under its own component name.

const components = {
  email: new EmailAuthDanceComponent({
    channel: "email",
    challenge: "email-code",
  }),
  "email-code": new OtpAuthDanceComponent({ channel: "email" }),
};

An OTP prompt is sendable. sendPrompt() creates a code, stores it for its TTL, and asks the named channel to deliver the message. A successful verification deletes the stored code.

Passwords

PasswordAuthDanceComponent requires a pepper. Keep it in a secret store. The default hasher uses PBKDF2-HMAC-SHA256; pass a custom PasswordHasher when the application needs another storage format.

const password = new PasswordAuthDanceComponent(passwordPepper);

TOTP

TOTP enrollment collects a base32 key and then verifies a code derived from it. generateKey and toURI help the client build the authenticator-app setup flow. Protect the identity store: it holds the shared key.

const totp = new TotpAuthDanceComponent({ digits: 6, period: 30 });

WebAuthn

WebAuthn requires a relying-party id. The default origin is https:// plus that id. A sign-in uses a discoverable credential, so the default resident-key setting is required.

const webauthn = new WebAuthnAuthDanceComponent({
  rp: { id: "example.com", name: "Example" },
  origins: ["https://example.com"],
  userVerification: "preferred",
});

The component supplies JSON ceremony options. The browser calls navigator.credentials.create() or navigator.credentials.get() and submits the credential JSON to the flow.

Build a custom factor

Implement AuthDanceComponent to return a prompt, collect identity records when needed, and verify answers. The component context carries the current flow, identity, storage, state id, and component name. Custom factors then work in every flow that traverses their choreography node.