Endpoints

Complete a two-factor challenge.

Exchanges the challenge returned by a 409 from POST /api/v1/sanctum/token for a permanent token. Send either a six-digit code from the authenticator app or one recovery_code. A challenge is single-use, expires after five minutes, and is burned after five wrong codes.

The two_factor_too_many_attempts 429 below burns the challenge, so the client must sign in with the password again to get a new one. This is distinct from the route's own rate limiter, whose 429 has a plain {"message", "status": 429} body (see App\Exceptions\Handler::handleApiException) and does not burn the challenge.

post/api/v1/sanctum/token/two-factor

Request

  • Base URL: https://hidemail.app
  • URL: https://hidemail.app/api/v1/sanctum/token/two-factor
  • Auth: none required

Request body

challengestring required

The challenge from the 409 response.

device_namestring required

Device Name. This is validated but not used to name the token: the device name recorded on the token is the one sent with the original POST /api/v1/sanctum/token request that issued this challenge.

codestring nullable

Six-digit authenticator code. Required unless recovery_code is present.

recovery_codestring nullable

A recovery code. Required unless code is present.

Example request

{
  "challenge": "3f9c...",
  "device_name": "Raycast",
  "code": "123456",
  "recovery_code": "abcde12345-fghij67890"
}

Response

Verified

tokenstring

Example response

{
  "token": "1a2b3c..."
}

Changes

No recorded changes to this operation across all 1 revision of this API.