Setting up OTP (One-Time Password) or MFA (Multi-Factor Authentication)

Setting up OTP (One-Time Password) or MFA (Multi-Factor Authentication) in Marketing Cloud involves generating and sending an OTP to the user and then verifying the OTP input on a CloudPage. Below are steps and sample code to achieve this using SSJS (Server-Side JavaScript) and AMPscript.

Step-by-Step Guide

1. Generate and Send OTP:

   • Generate a random OTP.

   • Store the OTP securely (using Data Extension).

   • Send the OTP to the customer via email or SMS.

2. OTP Verification Page:

   • Create a CloudPage where the customer will enter the OTP.

   • Verify the entered OTP against the stored OTP.

Step 1: Generate and Send OTP

SSJS Code to Generate and Send OTP

1. Create a Data Extension to store OTPs.

2. Use the following SSJS code to generate and send the OTP.

<script runat="server">Platform.Load("Core", "1.1.1");

// Generate a random 6-digit OTPvar otp = Math.floor(100000 + Math.random() * 900000).toString();

// Customer detailsvar customerEmail = "customer@example.com"; // Replace with customer's email// Data Extension where OTPs are storedvar otpDE = DataExtension.Init("OTP_Data_Extension");

// Store the OTP in the Data Extensionvar inserted = otpDE.Rows.Add({ "Email": customerEmail, "OTP": otp });

// Send the OTP to the customer via Emailvar emailDefinitionKey = "Your_Transactional_Email_Definition_Key";var sendStatus = TriggeredSend.Init(emailDefinitionKey).send({

    "EmailAddress": customerEmail,

    "SubscriberKey": customerEmail,

    "Attributes": {

        "OTP": otp

    }

});// Output the statusWrite("<br>OTP: " + otp);Write("<br>Send Status: " + Stringify(sendStatus));

</script>

Step 2: OTP Verification Page

AMPscript and SSJS Code to Verify OTP

Create a CloudPage for OTP verification where the user will enter the OTP.

%%[

/* AMPscript to handle form submission and verify OTP */

IF RequestParameter("submit") == "Submit" THEN

    VAR @inputOTP, @email, @rows, @row, @storedOTP

    /* Retrieve the email and OTP entered by the user */    SET @inputOTP = RequestParameter("otp")    SET @email = "customer@example.com" /* Replace with the actual email or retrieve dynamically */

    /* Lookup the stored OTP from the Data Extension */    SET @rows = LookupRows("OTP_Data_Extension", "Email", @email)

    IF RowCount(@rows) > 0 THEN        SET @row = Row(@rows, 1)        SET @storedOTP = Field(@row, "OTP")

        /* Compare the input OTP with the stored OTP */        IF @inputOTP == @storedOTP THEN            /* OTP is correct, grant access */            SET @accessGranted = "true"            /* Optionally, delete the OTP after successful verification */            DeleteDE("OTP_Data_Extension", "Email", @email)

        ELSE

            /* OTP is incorrect */

            SET @accessGranted = "false"

        ENDIF

    ELSE

        /* No OTP found for the email */

        SET @accessGranted = "false"

    ENDIF

ENDIF

]%%

<!DOCTYPE html><html><head><title>OTP Verification</title></head><body>

   %%[ IF @accessGranted == "true" THEN ]%%

       <p>OTP verified successfully! You now have access to the CloudPage.</p><!-- Protected content goes here -->

   %%[ ELSE ]%%

       <form method="post" action=""><label for="otp">Enter OTP:</label><input type="text" id="otp" name="otp" required><input type="submit" name="submit" value="Submit"></form>

       %%[ IF RequestParameter("submit") == "Submit" AND @accessGranted == "false" THEN ]%%

           <p style="color:red;">Invalid OTP. Please try again.</p>

       %%[ ENDIF ]%%

   %%[ ENDIF ]%%

</body></html>

Explanation

1. Generate and Send OTP:

   • The SSJS script generates a random OTP and stores it in a Data Extension.

   • The OTP is sent to the customer via a transactional email.

2. OTP Verification Page:

   • The AMPscript captures the OTP entered by the user and compares it with the stored OTP.

   • If the OTP matches, access is granted, and the OTP is optionally deleted from the Data Extension.

   • If the OTP doesn't match, an error message is displayed.

Make sure to replace placeholders like "customer@example.com", "Your_Transactional_Email_Definition_Key", and "OTP_Data_Extension" with actual values relevant to your setup.

This approach provides a basic implementation of OTP/MFA for Marketing Cloud pages.