--- sourceDocument: Australia Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security Release : - australia ft:locale : - en-US ft:publication_title : - Australia Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Explore authentication factors for AI voice agents # Explore authentication factors for AI voice agents {#ariaid-title1} Release version: Australia Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Explore authentication factors for AI voice agents Authentication factors are essential for securely identifying and verifying callers interacting with AI voice agents. In ServiceNow's AI voice environment, the process begins with caller identification, followed by authentication to ensure only authorized users gain access. Administrators configure the authentication types and methods that control caller access to voice agents, supporting both single-factor and multi-factor authentication (MFA) to enhance security. Show full answer Show less ## Authentication Types * **Single-factor authentication:** Requires verification through one authentication method, selected from the supported factors. * **Multi-factor authentication (MFA):** Requires sequential verification by two different methods (primary and secondary factors) to increase session assurance and protect sensitive data. MFA is enabled by default but can be disabled by setting the `glide.voice.authenticate.mfamandatory` system property to false. * **Step-up authentication:** An additional verification challenge required from an already authenticated caller before accessing AI voice agents handling sensitive requests, further strengthening security. ## Supported Authentication Factors ServiceNow supports six authentication factors, each configurable for keypad or voice input (although callers cannot switch modes at runtime): * **Time-based One-Time Password (TOTP):** Generated by authenticator apps like Okta Verify on a registered device. It is secure, resistant to interception, and suitable for both single-factor and MFA. * **Push Notification (Okta Verify):** Callers approve authentication via a push notification on their mobile device. This method requires an internet connection and is low-friction, effective as primary or secondary factor. * **Soft PIN:** A 6-digit PIN set up by the caller, device-independent and convenient across conversational AI channels. Because PINs can be shared or observed, Soft PIN is best combined with a second factor for sensitive actions. * **SMS One-Time Passcode (OTP):** Delivers a temporary code via SMS to the caller's registered mobile number. It is widely used but vulnerable to SIM-swapping and delivery delays, so it should not be the sole factor for critical operations. * **Email One-Time Passcode (OTP):** Sends a temporary code to the caller's registered email. Easy to deploy and familiar but susceptible to email compromise and phishing, thus not recommended alone for sensitive actions. * **Knowledge-Based Authentication (KBA):** Uses pre-configured security questions validated against ServiceNow AI Platform data or external systems. Primarily suited for identification and low-risk authentication; not recommended alone for sensitive actions due to social engineering risks. ## Practical Implications for ServiceNow Customers When implementing AI voice agents, selecting appropriate authentication factors is critical to balancing usability and security. Multi-factor authentication, enabled by default, offers higher protection and is advisable for sensitive environments. Step-up authentication provides an extra layer of security for high-risk requests. Administrators should configure factors based on the risk profile of the voice interaction and user convenience, considering the limitations and vulnerabilities of each method. Authentication factors are the elements used for caller identification and authentication. In secure voice agent environments, the process begins with identifying the caller, followed by authenticating their identity before granting access. A robust security strategy combines multiple factors to confirm that only authorized users interact with AI voice agents.{#explore-authentication-factors__patch-rn-zp4-1} When configuring an AI voice service to support natural, conversational exchanges, it's crucial to select authentication factors that reliably verify a user's identity. Caller access to specific voice agents is determined by the authentication types and methods configured by the administrator. In this context, two categories of authentication mechanisms are supported: ## Single-factor authentication {#explore-authentication-factors__section_kwv_sxw_mhc} Single-factor authentication requires the caller to verify their identity through one method. Any of the six supported factors can be configured as a standalone factor. ## Multi-factor authentication {#explore-authentication-factors__section_ich_zxw_mhc} Multi-factor authentication (MFA) requires callers to pass two verification methods in sequence. This raises the assurance level of the session and restricts access to sensitive data and actions. * Primary factor: The initial verification method (for example, Soft PIN or TOTP). * Secondary factor: An additional verification method that increases confidence in the caller's identity (for example, SMS OTP or Okta Verify push notification). Note: MFA is enabled by default. To make single-factor authentication the default behavior, set the glide.voice.authenticate.mfa_mandatory system property to false. {#explore-authentication-factors__ul_ngv_1yw_mhc} ## Step-up authentication {#explore-authentication-factors__section_step_up_authentication} You can also combine the factors with step-up authentication. Step-up authentication requires a caller who is already authenticated to complete an additional challenge before reaching an AI voice agent that handles a sensitive request. For more information, see [Step-up authentication](https://www.servicenow.com/docs/jErxtwraoW_uTTGurY4CnA "Step-up authentication requires a caller who is already authenticated to complete an additional challenge before reaching an AI voice agent that handles a sensitive request."). ## Overview of the supported authentication factors {#explore-authentication-factors__section_hrg_dyw_mhc} [Time-based one-time password (TOTP) authentication](https://www.servicenow.com/docs/Qt3HfedyBjWb2f7pqRsmHg "A time based one-time password (TOTP) is a secure authentication factor that verifies user identity by generating a unique, time-sensitive code.") : TOTP is a temporary numeric code generated by an authenticator app, such as Okta Verify, on the caller's registered device. Codes are generated locally and are resistant to interception, making TOTP well-suited for both single-factor and MFA configurations. The admin chooses keypad or voice for this factor. Callers can't switch at run time. [Push notification - Okta Verify](https://www.servicenow.com/docs/MBaX64TP9BRdQq0smmgQOg "The Okta Verify app push notification enables users to securely approve authentication requests directly on their enrolled mobile devices.") : Callers approve an authentication request via a push notification sent to their registered mobile device. This factor requires no code entry and is low-friction. It is effective as both a primary and secondary factor. An internet connection and a registered device with Okta Verify installed are required. [Soft PIN authentication](https://www.servicenow.com/docs/WkMgQWeorJIv1AKUB6bkLg "Soft PIN is a six-digit numeric PIN that verifies a caller's identity during an AI voice agent session.") : Soft PIN is a 6-digit numeric code the caller enrolls in advance. It is device-independent and quick to use across conversational AI channels, such as AI voice agents. The admin chooses keypad or voice for this factor. Callers can't switch at run time. Because a PIN can be observed or shared, Soft PIN is best used alongside a second factor for sensitive actions. [SMS One-time passcode (OTP) authentication](https://www.servicenow.com/docs/B1ZbdsvzMPF5Pis2R8HMJw "SMS one-time password (OTP) authentication is a method used to verify user identity by sending a temporary, numeric code to the user's registered mobile number. The user enters this code to complete authentication.") : SMS OTP delivers a temporary numeric code to the caller's registered mobile number. It is widely recognized and requires no app installation. The admin chooses keypad or voice for this factor. Callers can't switch at run time. SMS OTP is susceptible to SIM-swapping and delivery delays and should not be the sole factor for critical operations. [Email One-time passwords (OTP) authentication](https://www.servicenow.com/docs/fNQpvOKKNSKGgF62zkpqdg "Email OTP for AI voice agents sends a one-time numeric code to the caller's email address. The caller retrieves the code from their email and provides it to the agent to verify their identity.") : Email OTP delivers a temporary numeric code to the caller's registered email address. It is easy to deploy and familiar to most users. The admin chooses keypad or voice for this factor. Callers can't switch at run time. Email OTP is susceptible to email account compromise and phishing, and should not be used as a standalone factor for sensitive operations. [Knowledge-based authentication (Security Questions)](https://www.servicenow.com/docs/CLPpkAnRkKM3gKcY97f1Gw "Knowledge-based authentication (KBA) is an identification and authentication method that verifies callers by prompting them to answer preconfigured questions across conversational AI channels, such as AI voice agents. KBA can be used to identify a caller, authenticate a caller, or both within the same interaction.") : KBA presents the caller with pre-configured questions, such as "What are the last four digits of your employee ID?". The answers can be validated against ServiceNow AI Platform tables or external systems via custom scripts. KBA is used primarily for caller identification and low-risk authentication scenarios. Because answers can be social-engineered, KBA should not be used as a standalone factor for sensitive actions. The admin chooses keypad or voice for this factor. Callers can't switch at run time. [Step-up authentication](https://www.servicenow.com/docs/jErxtwraoW_uTTGurY4CnA "Step-up authentication requires a caller who is already authenticated to complete an additional challenge before reaching an AI voice agent that handles a sensitive request.") : Step-up authentication requires a caller who is already authenticated to complete an additional challenge before reaching an AI voice agent that handles a sensitive request. For details on configuring voice input for authentication factors, see [Configure voice input for authentication factors](https://www.servicenow.com/docs/MyKnAFhmlRyrrHf68xIEiA "Configure how callers provide authentication responses by speaking or using the phone keypad."). To learn more about voice service and how to create them, see [Create an AI voice assistant](https://www.servicenow.com/docs/access?context=create-an-ai-voice-service&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US). **Related concepts** * [Time-based one-time password (TOTP) authentication](https://www.servicenow.com/docs/Qt3HfedyBjWb2f7pqRsmHg "A time based one-time password (TOTP) is a secure authentication factor that verifies user identity by generating a unique, time-sensitive code.") * [Push notification - Okta Verify](https://www.servicenow.com/docs/MBaX64TP9BRdQq0smmgQOg "The Okta Verify app push notification enables users to securely approve authentication requests directly on their enrolled mobile devices.") * [Soft PIN authentication](https://www.servicenow.com/docs/WkMgQWeorJIv1AKUB6bkLg "Soft PIN is a six-digit numeric PIN that verifies a caller's identity during an AI voice agent session.") * [SMS One-time passcode (OTP) authentication](https://www.servicenow.com/docs/B1ZbdsvzMPF5Pis2R8HMJw "SMS one-time password (OTP) authentication is a method used to verify user identity by sending a temporary, numeric code to the user's registered mobile number. The user enters this code to complete authentication.") * [Email One-time passwords (OTP) authentication](https://www.servicenow.com/docs/fNQpvOKKNSKGgF62zkpqdg "Email OTP for AI voice agents sends a one-time numeric code to the caller's email address. The caller retrieves the code from their email and provides it to the agent to verify their identity.") * [Knowledge-based authentication (Security Questions)](https://www.servicenow.com/docs/CLPpkAnRkKM3gKcY97f1Gw "Knowledge-based authentication (KBA) is an identification and authentication method that verifies callers by prompting them to answer preconfigured questions across conversational AI channels, such as AI voice agents. KBA can be used to identify a caller, authenticate a caller, or both within the same interaction.")