---
title: "Finish a login that owes a second factor"
method: POST
path: "/v1/auth/2fa/verify"
tags: ["Auth"]
---

# Finish a login that owes a second factor

`POST /v1/auth/2fa/verify`

## Request

- Base URL: `https://api.briefgate.dev`
- URL: `https://api.briefgate.dev/v1/auth/2fa/verify`
- Auth: none required

Exchanges the challenge from /v1/auth/login for a session. Accepts a TOTP code or one recovery code. The challenge is single-use, expires in five minutes, and is burned after five wrong attempts.

## Request body

- object
  - `challenge` string, required
  - `code` string, required

## Response `200`

Signed in; the session cookie is set

## Other responses

- `401`: Invalid, expired or exhausted
- `422`: Validation error — the body shape is correct but values are invalid

---

[API](https://skmtc.dev/briefgate/apis/briefgate-api.md) · [All operations](https://skmtc.dev/briefgate/apis/briefgate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/briefgate/apis/briefgate-api/revisions/b21afed4748b?raw)