---
title: "Second login step for accounts with MFA enabled"
method: POST
path: "/v2/users/login/mfa"
tags: ["Users"]
---

# Second login step for accounts with MFA enabled

`POST /v2/users/login/mfa`

## Request

- Base URL: `https://api.chat.ethora.com`
- URL: `https://api.chat.ethora.com/v2/users/login/mfa`
- Auth: HTTP bearer

**Auth**: User JWT

When the account has MFA enabled, `POST /v1|v2/users/login-with-email`
and `POST /v1/users/login` (Google / Facebook / Apple / wallet signature)
stop after the first factor and answer
`{ mfaRequired: true, mfaToken, expiresIn: 300, methods: ['totp','backup'] }`
without creating a session. Exchange that token plus a 6-digit
authenticator code (or one backup code, `XXXXX-XXXXX`) here; the
response is identical to a normal login (token, refreshToken,
fileToken, wsToken, user, ...). App context as for login-with-email
(`appId` in the body or an app JWT).

## Request body

- object
  - `appId` string
  - `mfaToken` string, required: The pending token from login-with-email (valid 5 minutes).
  - `code` string, required: 6-digit TOTP code, or a backup code.

## Response `200`

Same payload as a successful login-with-email.

## Other responses

- `400`: Bad Request
- `401`: `MFA_TOKEN_INVALID` (expired / wrong app), `MFA_CODE_INVALID` (wrong, replayed, or already-used backup code), `MFA_NOT_ENABLED`.
- `403`: Forbidden
- `404`: Not Found
- `422`: Unprocessable Entity
- `500`: Internal Server Error

---

[API](https://skmtc.dev/ethora/apis/platform-api.md) · [All operations](https://skmtc.dev/ethora/apis/platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ethora/apis/platform-api/revisions/01b6e64378ee?raw)