diff --git a/tests/app/test_commands.py b/tests/app/test_commands.py
index 0d6fe2dfb..2f5a3fb4b 100644
--- a/tests/app/test_commands.py
+++ b/tests/app/test_commands.py
@@ -229,7 +229,7 @@ def test_create_test_user_command(notify_db_session, notify_api):
     # that user should be the one we added
     user = User.query.filter_by(name="Fake Personson").first()
     assert user.email_address == "somebody@fake.gov"
-    assert user.auth_type == "sms_auth"
+    assert user.auth_type == AuthType.SMS
     assert user.state == "active"
 
 
diff --git a/tests/app/test_model.py b/tests/app/test_model.py
index fec227dc1..549d95c9a 100644
--- a/tests/app/test_model.py
+++ b/tests/app/test_model.py
@@ -8,6 +8,7 @@ from app import encryption
 from app.enums import (
     AgreementStatus,
     AgreementType,
+    AuthType,
     NotificationStatus,
     RecipientType,
     TemplateType,
@@ -328,7 +329,7 @@ def test_user_can_use_webauthn_if_platform_admin(sample_user, is_platform_admin)
 
 @pytest.mark.parametrize(
     ("auth_type", "can_use_webauthn"),
-    [("email_auth", False), ("sms_auth", False), ("webauthn_auth", True)],
+    [(AuthType.EMAIL, False), (AuthType.SMS, False), (AuthType.WEBAUTHN, True)],
 )
 def test_user_can_use_webauthn_if_they_login_with_it(
     sample_user, auth_type, can_use_webauthn
diff --git a/tests/app/user/test_rest.py b/tests/app/user/test_rest.py
index 7be13a45c..3f4f22d67 100644
--- a/tests/app/user/test_rest.py
+++ b/tests/app/user/test_rest.py
@@ -210,7 +210,7 @@ def test_cannot_create_user_with_sms_auth_and_no_mobile(
 
     assert (
         json_resp["message"]
-        == "Mobile number must be set if auth_type is set to sms_auth"
+        == "Mobile number must be set if auth_type is set to AuthType.SMS"
     )
 
 
@@ -883,15 +883,15 @@ def test_activate_user_fails_if_already_active(admin_request, sample_user):
 
 
 def test_update_user_auth_type(admin_request, sample_user):
-    assert sample_user.auth_type == "sms_auth"
+    assert sample_user.auth_type == AuthType.SMS
     resp = admin_request.post(
         "user.update_user_attribute",
         user_id=sample_user.id,
-        _data={"auth_type": "email_auth"},
+        _data={"auth_type": AuthType.EMAIL},
     )
 
     assert resp["data"]["id"] == str(sample_user.id)
-    assert resp["data"]["auth_type"] == "email_auth"
+    assert resp["data"]["auth_type"] == AuthType.EMAIL
 
 
 def test_can_set_email_auth_and_remove_mobile_at_same_time(admin_request, sample_user):
@@ -922,7 +922,7 @@ def test_cannot_remove_mobile_if_sms_auth(admin_request, sample_user):
 
     assert (
         json_resp["message"]
-        == "Mobile number must be set if auth_type is set to sms_auth"
+        == "Mobile number must be set if auth_type is set to AuthType.SMS"
     )
 
 
diff --git a/tests/app/user/test_rest_verify.py b/tests/app/user/test_rest_verify.py
index bb0e06ec3..01c28bb25 100644
--- a/tests/app/user/test_rest_verify.py
+++ b/tests/app/user/test_rest_verify.py
@@ -425,7 +425,7 @@ def test_reset_failed_login_count_returns_404_when_user_does_not_exist(client):
     assert resp.status_code == 404
 
 
-# we send sms_auth users and webauthn_auth users email code to validate their email access
+# we send AuthType.SMS users and AuthType.WEBAUTHN users email code to validate their email access
 @pytest.mark.parametrize("auth_type", AuthType)
 @pytest.mark.parametrize(
     "data, expected_auth_url",
@@ -514,7 +514,7 @@ def test_send_email_code_returns_404_for_bad_input_data(admin_request):
 
 
 @freeze_time("2016-01-01T12:00:00")
-# we send sms_auth and webauthn_auth users email code to validate their email access
+# we send iAuthType.SMS and AuthType.WEBAUTHN users email code to validate their email access
 @pytest.mark.parametrize("auth_type", AuthType)
 def test_user_verify_email_code(admin_request, sample_user, auth_type):
     sample_user.logged_in_at = datetime.utcnow() - timedelta(days=1)