---
title: "Disable MFA"
method: DELETE
path: "/v1/auth/mfa"
tags: ["Authentication"]
---

# Disable MFA

`DELETE /v1/auth/mfa`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/auth/mfa`
- Auth: HTTP bearer

Requires a valid TOTP or recovery code in the body, or a passkey
re-auth token in `X-Auth-Confirm` (purpose `security.mfa.disable`).
Account password alone is not accepted while TOTP is enabled.

## Headers

- `X-Auth-Confirm` string

## Request body

- MfaDisableRequest
  - `code` string: TOTP or recovery code
  - `password` string: Deprecated. Password is no longer sufficient to disable MFA.

## Response `204`

MFA disabled

## Other responses

- `400`: Invalid request

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/ae109b496830?raw)