verifyMultiFactor

POST

/api/v1/auth/mfa/verify

curl --request POST \
  --url https://example.com/api/v1/auth/mfa/verify \
  --header 'Content-Type: application/json' \
  --data '{ "challengeToken": "example", "code": "example" }'

Completes a pending sign-in with an authenticator or recovery code.

Request Body^required

Media typeapplication/json

object

challengeToken

required

string

code

required

An authenticator code or a recovery code. The server decides which by shape; six digits are never matched against recovery codes.

string

Example^generated

{
  "challengeToken": "example",
  "code": "example"
}

Responses

200

Signed in

Media typeapplication/json

object

data

required

object

user

required

object

id

required

string format: uuid

name

required

string

username

required

string

role

required

Role key. The built-in roles are owner, administrator, editor, contributor, and viewer. Custom role keys start with “custom.”. Decide authorization from the capabilities the server reports, not from the role key.

string

/^[a-z][a-z0-9.-]{1,63}$/

active

required

boolean

createdAt

required

string format: date-time

lastLoginAt

string format: date-time

capabilities

Effective capabilities of the signed-in user’s role.

Array<string>

csrfToken

required

string

authMethod

required

string

Allowed values: password totp passkey recovery_code demo

mfaEnrollmentRequired

required

boolean

Example

{
  "data": {
    "user": {
      "role": "owner"
    },
    "authMethod": "password"
  }
}

401

Incorrect code or expired challenge

429

Too many incorrect codes