---
title: "Complete a two-factor login"
method: POST
path: "/v1/authentication/mfa/verify"
tags: ["Authentication"]
---

# Complete a two-factor login

`POST /v1/authentication/mfa/verify`

## Request

- Base URL: `https://api.assinafy.com.br`
- URL: `https://api.assinafy.com.br/v1/authentication/mfa/verify`
- Auth: none required

Exchanges the `mfa_token` returned by login for an access token. `code` is either the 6-digit code from the authenticator app or one of the recovery codes issued at enrollment. The challenge is single-use and expires 5 minutes after login.

[Copy as Markdown](https://api.assinafy.com.br/v1/docs/markdown?method=post&path=%2Fv1%2Fauthentication%2Fmfa%2Fverify) [Open in ChatGPT](https://chatgpt.com/?q=Read%20the%20API%20documentation%20at%20https%3A%2F%2Fapi.assinafy.com.br%2Fv1%2Fdocs%2Fmarkdown%3Fmethod%3Dpost%26path%3D%252Fv1%252Fauthentication%252Fmfa%252Fverify%20and%20help%20me%20integrate%20this%20endpoint.) [Open in Claude](https://claude.ai/new?q=Read%20the%20API%20documentation%20at%20https%3A%2F%2Fapi.assinafy.com.br%2Fv1%2Fdocs%2Fmarkdown%3Fmethod%3Dpost%26path%3D%252Fv1%252Fauthentication%252Fmfa%252Fverify%20and%20help%20me%20integrate%20this%20endpoint.)

## Request body

- object
  - `mfa_token` string, required: The token returned by the login response.
  - `code` string, required: A 6-digit authenticator code, or a recovery code such as ABCD-EFGH-JKMN.

## Response `200`

Access token, user and accounts

- object: Standard success wrapper. Operations add their own `data`.
  - `status` integer: HTTP status code, mirrored in the body.
  - `message` string: Human-readable message; empty on success.
  - `data` AuthSession: A JWT access token plus the authenticated user and the accounts they belong to.
    - `access_token` string
    - `user` AuthUser
      - `id` string
      - `name` string
      - `email` string, email
      - `telephone` string, nullable
      - `government_id` string, nullable
      - `is_email_verified` boolean
      - `has_accepted_terms` boolean
      - `created_at` string, date-time
      - `to_be_deleted_at` string, date-time, nullable
    - `accounts` AuthAccount[]
      - `id` string
      - `name` string
      - `roles` string[]
      - `is_delete_allowed` boolean
      - `created_at` string, date-time

## Other responses

- `400`: One or more fields failed validation.
- `401`: The challenge expired, was already used, or too many codes were tried
- `500`: Unexpected server error.

## Changes

- **2026-10-06** `f231647afa04`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/assinafy/apis/assinafy-api-reference/changes/v1/authentication/mfa/verify/post.md)

---

[API](https://skmtc.dev/assinafy/apis/assinafy-api-reference.md) - [All operations](https://skmtc.dev/assinafy/apis/assinafy-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/assinafy/apis/assinafy-api-reference/revisions/f7da81a5567e?raw)