---
title: "Verify backup codes challenge code"
method: POST
path: "/users/@me/mfa/backup-codes/challenge/verify"
tags: ["Users"]
---

# Verify backup codes challenge code

`POST /users/@me/mfa/backup-codes/challenge/verify`

Verifies the email code sent during a backup codes challenge and returns the existing backup codes along with a proof token. The code is consumed on success and the proof token authorizes regeneration on the same ticket.

## Request body

- MfaBackupCodesChallengeVerifyRequest
  - `ticket` string, required — Backup codes challenge ticket identifier
  - `code` string, required — Verification code sent to the email address

## Response `200`

Success

- MfaBackupCodesChallengeVerifyResponse
  - `backup_codes` object[], required — List of backup codes
    - `code` string, required — The backup code
    - `consumed` boolean, required — Whether the code has been used
  - `verification_proof` string, required — Proof token authorizing backup code regeneration on this ticket

## Other responses

- `400` — Bad Request - The request was malformed or contained invalid data
- `401` — Unauthorized - Authentication is required or the token is invalid
- `403` — Forbidden - You do not have permission to perform this action
- `429` — Too Many Requests - You are being rate limited
- `500` — Internal Server Error - An unexpected error occurred

## Changes

- **2026-09-03** `f6d51a9b1034` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/fluxer/apis/fluxer-api/changes/users/@me/mfa/backup-codes/challenge/verify/post.md)

---

[API](https://skmtc.dev/fluxer/apis/fluxer-api.md) · [All operations](https://skmtc.dev/fluxer/apis/fluxer-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/fluxer/fluxer-api/revisions/f6d51a9b1034/schema)