---
title: Challenge/Response Authentication in Access Server
canonical: https://openvpn.net/as-docs/challenge-response/
product: Access Server Docs
description: OpenVPN's Access Server supports implementing challenge/response authentication in addition to username/password.
---

# Challenge/Response Authentication in Access Server

Access Server supports challenge-response authentication via a post-authentication script (PAS). This allows administrators to introduce an interactive authentication step in which users must respond to a dynamically generated challenge before the VPN session is established.

With challenge/response authentication enabled, Access Server:

- Prompts the user with a challenge during login.
- Evaluates the user's response using custom logic defined in a Python 3 PAS.
- Allows or denies the VPN connection based on the validation result.

This mechanism can be used to:

- Integrate with external verification systems.
- Implement custom multi-factor authentication workflows.
- Enforce additional security checks beyond standard credentials.

Challenge/response logic is executed during the post-authentication hook, before the VPN session is fully established.

- [Tutorial: Implementing a Challenge/Response Authentication in Access Server](https://openvpn.net/as-docs/tutorials/tutorial--challenge-response-authentication.md)

> **Important**
>
> Challenge/response authentication is implemented through a custom post-authentication script. The administrator is responsible for designing, testing, and maintaining the validation logic. Improper implementation may prevent legitimate users from connecting or introduce security risks.

---

Prev: [iVALT 2FA](https://openvpn.net/as-docs/ivalt-2fa.md)
Next: [Custom Authentication System](https://openvpn.net/as-docs/custom-authentication-system.md)
Index: https://openvpn.net/as-docs/llms.txt