---
title: "Verify backup code"
method: POST
path: "/api/auth/totp/verify-backup-code"
tags: ["TOTP Plugin"]
---

# Verify backup code

`POST /api/auth/totp/verify-backup-code`

Verifies a backup code as an alternative to TOTP verification. Completes authentication if the code is valid.

## Request body

- VerifyBackupCodeRequest
  - `code` string, required
  - `trust_device` boolean

## Response `200`

OK

- VerifyBackupCodeResponse
  - `session` Session, required
    - `created_at` string, date-time, required
    - `expires_at` string, date-time, required
    - `id` string, required
    - `ip_address` string, nullable
    - `token` string, required
    - `updated_at` string, date-time, required
    - `user_agent` string, nullable
    - `user_id` string, required
  - `user` User, required
    - `created_at` string, date-time, required
    - `email` string, required
    - `email_verified` boolean, required
    - `id` string, required
    - `image` string, nullable
    - `metadata` object, nullable
    - `name` string, required
    - `updated_at` string, date-time, required

## Changes

- **2026-07-08** `61a78375af21` — 12 info
  - the response property `session/created_at` became required for the status `200`
  - the response property `session/expires_at` became required for the status `200`
  - the response property `session/id` became required for the status `200`
  - the response property `session/token` became required for the status `200`
  - …8 more
- **2026-07-08** `ee53eca042f6` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/authula/apis/authula-api/changes/api/auth/totp/verify-backup-code/post.md)

---

[API](https://skmtc.dev/authula/apis/authula-api.md) · [All operations](https://skmtc.dev/authula/apis/authula-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authula/authula-api/revisions/4f40429caade/schema)