---
title: "Regenerate backup codes with a verified challenge"
method: POST
path: "/users/@me/mfa/backup-codes/challenge/regenerate"
tags: ["Users"]
---

# Regenerate backup codes with a verified challenge

`POST /users/@me/mfa/backup-codes/challenge/regenerate`

## Request

- Base URL: `https://web.fluxer.app/api/v1`
- URL: `https://web.fluxer.app/api/v1/users/@me/mfa/backup-codes/challenge/regenerate`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/fluxer/apis/fluxer-api/docs/users/@me/mfa/backup-codes/challenge/regenerate/post.ts> (a function with typed inputs; its response is checked against the schema)

Replaces the account backup codes using the proof token from a verified backup codes challenge. Old codes are invalidated.

## Request body

- MfaBackupCodesChallengeRegenerateRequest
  - `ticket` string, required: Backup codes challenge ticket identifier
  - `verification_proof` string, required: Proof token obtained from verifying the email code

## Response `200`

Success

- MfaBackupCodesResponse
  - `backup_codes` object[], required: List of backup codes
    - `code` string, required: The backup code
    - `consumed` boolean, required: Whether the code has been used

## Other responses

- `400`: Bad Request - The request was malformed or contained invalid data
- `401`: Unauthorized - Authentication is required or the token is invalid
- `403`: Forbidden - You do not have permission to perform this action
- `429`: Too Many Requests - You are being rate limited
- `500`: Internal Server Error - An unexpected error occurred

## Changes

> 66 revisions in range; 2 not diffed.

- **2026-09-06** `a52a2cf49d9b`: 32 warning
  - added the new `IP_BAN_DECLINED` enum value to the `code` response property for the response status `400`
  - added the new `IP_BAN_DECLINED` enum value to the `code` response property for the response status `401`
  - added the new `IP_BAN_DECLINED` enum value to the `code` response property for the response status `403`
  - added the new `IP_BAN_DECLINED` enum value to the `code` response property for the response status `500`
  - …28 more
  - …this revision’s changelog is incomplete
- **2026-09-05** `4dbb738a3e22`: 4 info
  - removed the `NSFW_EMOJI_STICKER_BLOCKED` enum value from the `code` response property for the response status `400`
  - removed the `NSFW_EMOJI_STICKER_BLOCKED` enum value from the `code` response property for the response status `401`
  - removed the `NSFW_EMOJI_STICKER_BLOCKED` enum value from the `code` response property for the response status `403`
  - removed the `NSFW_EMOJI_STICKER_BLOCKED` enum value from the `code` response property for the response status `500`
- **2026-09-03** `f6d51a9b1034`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/fluxer/apis/fluxer-api/changes/users/@me/mfa/backup-codes/challenge/regenerate/post.md)

---

[API](https://skmtc.dev/fluxer/apis/fluxer-api.md) - [All operations](https://skmtc.dev/fluxer/apis/fluxer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fluxer/apis/fluxer-api/revisions/c56605b6a92d?raw)