Authentication

Login Complete With Mfa

Second step of the password login flow: exchange a pending MFA token + a valid TOTP code (or recovery code) for a real session JWT.

Race protection is at the SQLite layer: claim_totp_counter and consume_recovery_code are conditional UPDATEs that succeed only if the underlying value is still the one we verified against. Two concurrent requests with the same captured code race to the UPDATE; one wins, the other's WHERE clause fails to match and the request is rejected.

post/api/auth/token/mfa

Request

  • Base URL: https://app.getdot.ai (the document declares no server; this is the origin it was published from)
  • URL: https://app.getdot.ai/api/auth/token/mfa
  • Auth: none declared

Request body

mfa_tokenstring required
codestring nullable
recovery_codestring nullable

Response

Successful Response

unknown required

Changes

No recorded changes to this operation across all 1 revision of this API.