Skip to main content

Step Up Authentication

<sl-step-up-authentication> | SlStepUpAuthentication
Since 2.14.0 experimental

A step-up authentication component for verifying user identity with SMS/email codes.

<sl-step-up-authentication></sl-step-up-authentication>

Examples

Basic Step-Up Authentication

The default component displays a verification form with a 6-digit OTP input for SMS verification.

<sl-step-up-authentication id="basic-example"></sl-step-up-authentication>

<script>
  const auth = document.getElementById('basic-example');
  
  auth.addEventListener('sl-verify', (e) => {
    console.log('Code to verify:', e.detail.code);
    auth.loading = true;
    
    setTimeout(() => {
      auth.loading = false;
      alert('Verification successful! Code: ' + e.detail.code);
      auth.clear();
    }, 1500);
  });

  auth.addEventListener('sl-resend', () => {
    console.log('Resend code requested');
    alert('New verification code sent!');
  });
</script>

Custom Contact Information

Customize the message and masked contact information.

<sl-step-up-authentication
  title="Email Verification"
  message="We've sent a 6-digit code to: "
  masked-contact="user@*****.com"
></sl-step-up-authentication>

Different Code Lengths

Use the length attribute to change the number of digits required.



<sl-step-up-authentication
  title="Enter Your PIN"
  message="Please enter your 4-digit security PIN"
  masked-contact=""
  length="4"
  verify-text="Unlock"
></sl-step-up-authentication>

<br /><br />

<sl-step-up-authentication
  title="Enter Verification Code"
  message="Enter the 8-digit code from your authenticator app"
  masked-contact=""
  length="8"
></sl-step-up-authentication>

With Cancel Button

Enable the cancel button for scenarios where users can opt out of verification.

<sl-step-up-authentication
  show-cancel
  cancel-text="Go Back"
  id="cancel-example"
></sl-step-up-authentication>

<script>
  document.getElementById('cancel-example').addEventListener('sl-cancel', () => {
    alert('Authentication cancelled');
  });
</script>

Loading State

Use the loading attribute to indicate processing is in progress.


Toggle Loading
<sl-step-up-authentication
  loading
  id="loading-demo"
></sl-step-up-authentication>

<br />
<sl-button onclick="document.getElementById('loading-demo').loading = !document.getElementById('loading-demo').loading">
  Toggle Loading
</sl-button>

Custom Content

Use the default slot to add additional content like alerts or instructions.

Security Notice: For your protection, we need to verify your identity.
<sl-step-up-authentication>
  <sl-alert variant="primary" open>
    <sl-icon slot="icon" name="fas-circle-info"></sl-icon>
    <strong>Security Notice:</strong> For your protection, we need to verify your identity.
  </sl-alert>
</sl-step-up-authentication>

Auto-Verify

Enable automatic verification when the code is complete. The verify button will be hidden and verification happens automatically when all digits are entered.

<sl-step-up-authentication
  auto-verify
  id="auto-verify-example"
  title="Quick Verification"
  message="Code will be verified automatically when complete"
  masked-contact="*******1100"
></sl-step-up-authentication>

<div id="auto-verify-result" style="margin-top: 16px; padding: 12px; background: #f0f0f0; border-radius: 4px; display: none;">
  <strong>Verification Result:</strong> <span id="result-text"></span>
</div>

<script>
  const autoAuth = document.getElementById('auto-verify-example');
  const resultDiv = document.getElementById('auto-verify-result');
  const resultText = document.getElementById('result-text');
  
  autoAuth.addEventListener('sl-verify', (e) => {
    console.log('Auto-verifying code:', e.detail.code);
    autoAuth.loading = true;
    
    setTimeout(() => {
      autoAuth.loading = false;
      resultDiv.style.display = 'block';
      resultDiv.style.background = '#d4edda';
      resultDiv.style.color = '#155724';
      resultText.textContent = 'Code ' + e.detail.code + ' verified successfully!';
      
      setTimeout(() => {
        autoAuth.clear();
        resultDiv.style.display = 'none';
      }, 3000);
    }, 1000);
  });

  autoAuth.addEventListener('sl-resend', () => {
    resultDiv.style.display = 'block';
    resultDiv.style.background = '#d1ecf1';
    resultDiv.style.color = '#0c5460';
    resultText.textContent = 'New verification code sent!';
    setTimeout(() => {
      resultDiv.style.display = 'none';
    }, 2000);
  });
</script>

Send Code API

The component provides a complete flow for sending and verifying codes. Use the sendCodeHandler property or sendCode() method to integrate with your backend API.

<sl-step-up-authentication
  id="send-code-example"
  message-before-send="We will send a SMS with a 6-digit code to: "
  message-after-send="We've sent a SMS with a 6-digit code to: "
  masked-contact="+1 (555) ***-1234"
  auto-verify
></sl-step-up-authentication>

<script>
  const sendAuth = document.getElementById('send-code-example');
  
  // Set up send code handler
  sendAuth.sendCodeHandler = async () => {
    // Simulate API call to send verification code
    console.log('Calling API to send verification code...');
    
    await new Promise(resolve => setTimeout(resolve, 1500));
    console.log('Verification code sent!');
    
    // If the API call fails, throw an error:
    // throw new Error('Failed to send code');
  };
  
  // Handle verification
  sendAuth.addEventListener('sl-verify', async (e) => {
    console.log('Verifying code:', e.detail.code);
    sendAuth.loading = true;
    
    try {
      // Simulate API call to verify code
      await new Promise(resolve => setTimeout(resolve, 1000));
      
      // Simulate success/error based on code
      if (e.detail.code === '123456') {
        sendAuth.showSuccess();
      } else {
        sendAuth.showError('Enter a valid code');
      }
    } catch (error) {
      sendAuth.showError(error.message);
    }
  });
  
  // Handle resend
  sendAuth.addEventListener('sl-resend', async () => {
    console.log('Resending verification code...');
    
    // You can call sendCode() programmatically
    await sendAuth.sendCode();
  });
</script>

You can hide the resend link by setting show-resend="false":

<sl-step-up-authentication
  id="no-resend-example"
  message-before-send="We will send a code to your preferred authentication app."
  message-after-send="Check your preferred authentication app for your code and enter it below."
  masked-contact=""
  auto-verify
  show-resend="false"
></sl-step-up-authentication>

<script>
  const noResendAuth = document.getElementById('no-resend-example');
  
  // Explicitly set showResend to false
  noResendAuth.showResend = false;
  console.log('showResend property:', noResendAuth.showResend);
  
  // Set up send code handler
  noResendAuth.sendCodeHandler = async () => {
    console.log('Calling API to send verification code...');
    await new Promise(resolve => setTimeout(resolve, 1500));
    console.log('Verification code sent!');
  };
  
  // Handle verification
  noResendAuth.addEventListener('sl-verify', async (e) => {
    console.log('Verifying code:', e.detail.code);
    noResendAuth.loading = true;
    
    try {
      await new Promise(resolve => setTimeout(resolve, 1000));
      
      if (e.detail.code === '123456') {
        noResendAuth.showSuccess();
      } else {
        noResendAuth.showError('Enter a valid code');
      }
    } catch (error) {
      noResendAuth.showError(error.message);
    }
  });
</script>

Custom Button Text

Customize the verify, cancel, and resend text.

<sl-step-up-authentication
  verify-text="Confirm Code"
  resend-text="Send Again"
  show-cancel
  cancel-text="Skip"
></sl-step-up-authentication>

API Methods

The component exposes several methods for programmatic control:

Set Value Get Value Clear Focus Is Complete? Trigger Verify
<sl-step-up-authentication id="api-example"></sl-step-up-authentication>

<div style="display: flex; gap: 8px; margin-top: 16px; flex-wrap: wrap;">
  <sl-button size="small" onclick="document.getElementById('api-example').setValue('123456')">
    Set Value
  </sl-button>
  <sl-button size="small" onclick="alert(document.getElementById('api-example').getValue())">
    Get Value
  </sl-button>
  <sl-button size="small" onclick="document.getElementById('api-example').clear()">
    Clear
  </sl-button>
  <sl-button size="small" onclick="document.getElementById('api-example').focus()">
    Focus
  </sl-button>
  <sl-button size="small" onclick="alert(document.getElementById('api-example').isComplete())">
    Is Complete?
  </sl-button>
  <sl-button size="small" onclick="document.getElementById('api-example').verify()">
    Trigger Verify
  </sl-button>
</div>

Available Methods

Method Description
getValue() Returns the current OTP code value as a string
setValue(value: string) Sets the OTP code programmatically
isComplete() Returns boolean indicating if all digits are filled
clear() Clears the OTP input and resets state
focus(options?) Sets focus on the OTP input
verify() Programmatically triggers verification (if code is complete)
resend() Programmatically triggers the resend action
sendCode() Programmatically triggers sending the verification code
reset() Resets component to initial state (shows Send Code button)
showSuccess() Shows success feedback and clears error state
showError(message?) Shows error feedback with optional error message

Available Properties

Property Description
sendCodeHandler Async function called when sending code. Return a promise that resolves on success.
messageBeforeSend Message shown before code is sent (default: “We will send a SMS with a 6-digit code to: ”)
messageAfterSend Message shown after code is sent (default: “We’ve sent a SMS with a 6-digit code to: ”)
errorMessage Error message to display below OTP input
autoVerify Automatically verify when code is complete (hides verify button)

[component-metadata:sl-step-up-authentication]

Slots

Name Description
(default) The default slot for additional content or custom instructions.
header Optional custom header content.
footer Optional custom footer content.

Learn more about using slots.

Properties

Name Description Reflects Type Default
title The title text displayed at the top. string 'Verify your identity'
messageBeforeSend
message-before-send
The message shown before sending code. string 'We will send a SMS with a 6-digit code to: '
messageAfterSend
message-after-send
The message shown after code is sent. string "We've sent a SMS with a 6-digit code to: "
maskedContact
masked-contact
The masked phone number or email address. string '*******1100'
length The length of the OTP code. number 6
showCancel
show-cancel
Whether to show the cancel button. boolean false
hideResend
hide-resend
Whether to hide the resend link. boolean false
verifyText
verify-text
The verify button text. string 'Verify'
cancelText
cancel-text
The cancel button text. string 'Cancel'
resendText
resend-text
The resend link text. string 'Resend code'
loading Whether the component is in a loading state. boolean false
disabled Disables the component. boolean false
variant The variant of the component appearance. 'default' | 'primary' 'default'
autoVerify
auto-verify
Automatically trigger verification when code is complete. boolean false
sendText
send-text
The send code button text. string 'Send code'
errorMessage
error-message
Error message to display below the OTP input. string ''
sendCodeHandler Optional callback function to send the code. Return a promise that resolves on success. () => Promise | undefined -
updateComplete A read-only promise that resolves when the component has finished updating.

Learn more about attributes and properties.

Events

Name React Event Description Event Detail
sl-verify Emitted when the verify button is clicked with a complete code. -
sl-resend Emitted when the resend code link is clicked. -
sl-send Emitted when the send code button is clicked. -
sl-cancel Emitted when the cancel button is clicked (if enabled). -

Learn more about events.

Methods

Name Description Arguments
sendCode() Programmatically send the code. -
clear() Clears the OTP input. -
reset() Resets the component to initial state (before send code). -
focus() Sets focus on the OTP input. options: FocusOptions
getValue() Gets the current OTP code value. -
setValue() Sets the OTP code value programmatically. value: string
isComplete() Returns whether the code is complete. -
verify() Programmatically trigger verification. -
resend() Programmatically trigger resend. -
showError() Show an error state (for external validation feedback). message: string
showSuccess() Show a success state (for external validation feedback). -

Learn more about methods.

Parts

Name Description
base The component’s base wrapper.
card The card container.
header The header section.
title The title text.
message The message text showing where code was sent.
content The main content area.
label The input label.
opt-input The OTP input component.
actions The action buttons container.
buttons The buttons wrapper.
verify-button The verify button.
cancel-button The cancel button.
resend The resend section.
resend-link The resend code link.

Learn more about customizing CSS parts.

Dependencies

This component automatically imports the following dependencies.

  • <sl-button>
  • <sl-card>
  • <sl-icon>
  • <sl-opt-input>
  • <sl-spinner>