---
title: "Sign In Totp"
method: POST
path: "/api/auth/totp"
tags: ["auth"]
---

# Sign In Totp

`POST /api/auth/totp`

## Request

- Base URL: `https://api.getcheapgames.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.getcheapgames.com/api/auth/totp`
- Auth: none declared

The second step of a sign-in: the challenge `/password` or `/reset`
answered (or, after a provider, the one in the challenge cookie), and a
code from the app or a recovery code. 410 `challenge-expired` for a
sign-in to start again, 401 `wrong-code`, 429 past the account's five
tries in fifteen minutes, counted against the account the challenge is
for, whichever browser tries.

## Response `200`

Successful Response

- GcgAccountsSchemasSignInOut: `ok` with the user and the cookies set, or `totp` with a challenge to answer.
  - `status` 'ok' | 'totp', required
  - `user` MeOut: The signed-in account, as `/api/account/me` and every sign-in answer it.
    - `id` integer, required
    - `username` string, required
    - `email` string, nullable, required
    - `emailVerified` boolean, required
    - `twoFactor` boolean, required
    - `methods` MethodsOut, required: The ways this account can sign in.
      - `password` boolean, required
      - `google` boolean, required
      - `steam` boolean, required
      - `epic` boolean, required
    - `platforms` string[], required
    - `createdAt` string, date-time, required
  - `challenge` string, nullable

---

[API](https://skmtc.dev/getcheapgames/apis/getcheapgames-api.md) · [All operations](https://skmtc.dev/getcheapgames/apis/getcheapgames-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getcheapgames/apis/getcheapgames-api/revisions/57333a690301?raw)