docs(mfa): the MFA session is not browser-only

[lakhansamani]

The MFA page said "the frontend authenticates the follow-up call … via a short-lived MFA session cookie". Read as browser-only — which is exactly how two SDKs independently concluded they had to emulate a user agent, one of them shipping a cookie-injection hole on the way.

It is an ordinary Set-Cookie header carrying an opaque handle, and the server accepts it back in an ordinary Cookie header. Any HTTP client can complete the flow. Verified end to end against a running server:

# signup withholds the token and puts the handle on the wire
Set-Cookie: mfa_session=e415fa93-f51e-4ee1-8568-bd7cf2e0fa67
{"data":{"signup":{"access_token":null,"message":"Proceed to mfa setup"}}}

# echo it back — no cookie jar
access_token issued: True

What's added

• The two-command curl recipe, which is the entire integration.
• The gRPC equivalent (set-cookie metadata in, cookie metadata out).
• The one invariant a jar would have given for free: attach it only to your configured Authorizer base URL, never across a redirect. skip_mfa_setup exchanges the handle for a full access token, so it is a credential — memory only, never logged, never persisted.
• Why a general-purpose jar is the wrong tool: Secure cookies dropped over http://localhost, and domain-matching rules that vary by language. Those are precisely the bugs both SDKs hit.

Cross-linked from skip_mfa_setup in the GraphQL API reference, since that is where someone lands when the token comes back null.

Companion to authorizerdev/authorizer-py#15, which replaces the Python SDK's cookie jar with this pattern.

npm run build — exit 0, no broken links or anchors.

[netlify]

✅ Deploy Preview for authorizerdev-docs ready!

Name	Link
🔨 Latest commit	317daf6
🔍 Latest deploy log	https://app.netlify.com/projects/authorizerdev-docs/deploys/6a82c220054c710008f5bbd1
😎 Deploy Preview	https://deploy-preview-93--authorizerdev-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.