---
title: "Mfa Confirm"
method: POST
path: "/api/auth/mfa/confirm"
tags: ["Authentication"]
---

# Mfa Confirm

`POST /api/auth/mfa/confirm`

## Request

- Base URL: `https://app.getdot.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://app.getdot.ai/api/auth/mfa/confirm`
- Auth: one of:
  - API key in header `X-API-KEY`
  - API key in cookie `Authorization`
  - OAuth 2 (password, token URL `/api/auth/token`)

Confirm enrollment by verifying the first TOTP code.

On success: promote pending → active secret, generate 10 recovery codes,
persist their bcrypt hashes, and return the plaintext codes ONCE. The
frontend MUST surface them to the user immediately — they are never
retrievable again.

When called with an enrollment pending token (org-enforcement path), the
response *also* carries a full access_token and sets the auth cookie —
the user has now satisfied both factors and should be logged in. When
called with an existing session (Profile opt-in), no new session is
minted; the existing cookie keeps working.

## Request body

- BodyMfaConfirmApiAuthMfaConfirmPost
  - `code` string, required
  - `mfa_token` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/getdot/apis/dot-api-2.md) · [All operations](https://skmtc.dev/getdot/apis/dot-api-2/llms.txt) · [OpenAPI document](https://skmtc.dev/getdot/apis/dot-api-2/revisions/d26fe7163a7f?raw)