---
title: "Totp Forgot"
method: POST
path: "/api/auth/totp/forgot"
tags: ["auth"]
---

# Totp Forgot

`POST /api/auth/totp/forgot`

## Request

- Base URL: `https://kernelscan.io`
- URL: `https://kernelscan.io/api/auth/totp/forgot`
- Auth: none declared

Email-recovery for a lost authenticator. Requires email AND current password.

Always returns 200 — and always runs bcrypt against either the real hash
or a dummy — so neither the existence of the account nor whether 2FA is
on can be inferred from response timing.

## Response `200`

Successful Response

- object

---

[API](https://skmtc.dev/kernelscan/apis/kernelscan-api.md) · [All operations](https://skmtc.dev/kernelscan/apis/kernelscan-api/llms.txt) · [OpenAPI document](https://skmtc.dev/kernelscan/apis/kernelscan-api/revisions/4fa51d41484e?raw)