I assume you mean through Joomla's web services API? We don't have any endpoints for that yet. The plan was to add support for that in CB 3.x when we've implemented our new router. MFA wouldn't be of any help in this regard you'd need to give them their backend bearer tokens to authenticate through Joomla.

An alternative is to expose the auto action to the public and add your own token authentication to the conditions of the auto action. You can set User to Custom to extract a user from that token. So for example maybe you've a CB field where you give them generated tokens. When the auto action URL is accessed with that token find the user associated with it in the customer user parsing behavior.

What do you mean by "find the user associated with it in the customer user parsing behavior." ?

You can implement your own SQL or PHP based user parsing for CB Auto Actions. Example as follows.

User: Query
User (new Tab next to Global):Substitutions and Format Functions toggled on

That would set the user used by the auto action by matching the &token=TOKEN_HERE in the auto action URL with the field cb_token. I suggest also adding a condition to make sure token isn't empty. Each user in this case would need to be given their own token via the cb_token field that you want to have access.

Great like this I could also double check with a domain associated for the user and registered in a cb field 

If you wanted to, yes.

Then I can protect the fields against a CB Subscription and also limit the url to the CBsubs valid subscription , correct ?

Yes.

Is there a cb field type that could finally allow an automatic display of code/token for my users 

Not one that'd be stored in the database. You could generate a code using PHP and a Code field using a reversable encryption method. Then instead of setting User to Query set it to Code and reverse the encrypt. Joomla actually comes with API to do this. Example as follows.

Encode

Decode


That would encode the $userId using the $key, which is site specific (using Joomla site secret) and has a special string added (e.g. in this case autoaction_key, but can be whatever you want). When decoding the result of the encoded string with the same key you'll get the user id. Note this is just an example I did not test the above as working code, but probably should work fine.