# step-up-auth

Source: https://startwithidentity.com/glossary/step-up-auth/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Requiring additional authentication when a user attempts a higher-risk action, such as changing email or initiating a large payment. Implemented via OIDC `acr_values` and `amr` claims in modern stacks.

Step-up is how you keep everyday access frictionless without leaving sensitive operations protected only by a session from three days ago. Implement it as a property of the action rather than of the login: changing a recovery email, adding a payee, or exporting data should each declare the assurance they require, and the application should ask for it at that moment.

See also: [adaptive auth](https://startwithidentity.com/glossary/adaptive-auth/), [risk-based auth](https://startwithidentity.com/glossary/risk-based-auth/), [MFA](https://startwithidentity.com/glossary/mfa/), [SCA](https://startwithidentity.com/glossary/sca/)