Cf offers no direct mfa function. Instead, other providers do and you can integrate with them. And you could do that via api calls (such as simply using cfhttp), or via oauth (using cfoauth or cfhttp, etc.), or via SSO (single sign on) such as by way of saml using support for that added in cf2021.

None is simply “mfa for cf”, and some will be free while others will incur cost (perhaps depending on volume). Most things you may integrate with will not mention cf, but the concepts and integration points are generic.

I suspect you’ll next want to be pointed to actual code or a live example. Once you clarify a bit more I can do that, or perhaps others will without any further ado.