title: Okta multi-factor authentication at both org and app level
body: <p>I have assigned the AWS app to my Okta account and configured MFA at both the org and app level. I successfully implemented MFA with API's at the org level in the following way:</p>
  
  <ol>
  <li>POST Username and Password JSON request to <code>/api/v1/authn</code> and receive the state token and factor details in the response.   </li>
  <li>If the response contains "MFA Required", then use the factor details received in step 1 and call <code>/api/v1/authn/factors/:fid/verify</code> and get the session token in response.</li>
  </ol>
  
  <p>This completes the org level authentication. I then call the AWS app with the session token received in the above step for app level - <code>https://&lt;AWS APP URL&gt;?onetimetoken='SessionToken'</code>. Now this takes me to the login page again. If I repeat the steps 1 and 2, then org level MFA is being done again and not app level MFA.</p>
  
  <p>Any pointers in implementing app level MFA?</p>