---
title: "Disable two-factor authentication"
method: POST
path: "/account/two-factor/disable"
tags: ["Admin Authentication"]
---

# Disable two-factor authentication

`POST /account/two-factor/disable`

## Request

- Base URL: `http://localhost:8000/api/admin`
- URL: `http://localhost:8000/api/admin/account/two-factor/disable`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/bagisto/apis/bagisto-admin-api/docs/account/two-factor/disable/post.ts> (a function with typed inputs; its response is checked against the schema)

Turns two-factor authentication off and clears the secret and backup codes. While it is enabled, `code` must carry a current authenticator code or an unused backup code.

## Request body

- object
  - `code` string

## Response `200`

Disabled.

## Other responses

- `400`: Invalid input
- `401`: Missing or invalid admin token.
- `422`: Missing or invalid code.

## Changes

- **2026-10-28** `3198f11be70f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/bagisto/apis/bagisto-admin-api/changes/account/two-factor/disable/post.md)

---

[API](https://skmtc.dev/bagisto/apis/bagisto-admin-api.md) - [All operations](https://skmtc.dev/bagisto/apis/bagisto-admin-api/llms.txt) - [OpenAPI document](https://skmtc.dev/bagisto/apis/bagisto-admin-api/revisions/3198f11be70f?raw)