Authentication

Mfa Confirm

Confirm enrollment by verifying the first TOTP code.

On success: promote pending → active secret, generate 10 recovery codes, persist their bcrypt hashes, and return the plaintext codes ONCE. The frontend MUST surface them to the user immediately — they are never retrievable again.

When called with an enrollment pending token (org-enforcement path), the response also carries a full access_token and sets the auth cookie — the user has now satisfied both factors and should be logged in. When called with an existing session (Profile opt-in), no new session is minted; the existing cookie keeps working.

post/api/auth/mfa/confirm

Request

  • Base URL: https://app.getdot.ai (the document declares no server; this is the origin it was published from)
  • URL: https://app.getdot.ai/api/auth/mfa/confirm
  • Auth: one of:
    • API key in header X-API-KEY
    • API key in cookie Authorization
    • OAuth 2 (password, token URL /api/auth/token)

Request body

codestring required
mfa_tokenstring nullable

Response

Successful Response

unknown required

Changes

No recorded changes to this operation across all 1 revision of this API.