Sign in
Authentication (Allauth Headless)

Two-factor authentication

Changed on

If, during authentication, a response with status 401 is encountered where one of the pending flows has ID mfa_authenticate, that indicates that the Two-Factor Authentication stage needs to be completed.

post/api/v2/allauth/browser/v1/auth/2fa/authenticate

Request

  • The document declares no server URL.
  • Auth: none declared

Path parameters

client'app' | 'browser' required

The type of client accessing the API.

Headers

X-Session-Tokenstring

Session token. Only needed when client is equal to app.

Request body

codestring required

An authenticator code.

Example request

{
  "code": "314159"
}

Response

Authenticated by password and 2FA.

status200 required

Example response

{
  "data": {
    "user": {
      "id": 123,
      "display": "Magic Wizard",
      "email": "email@domain.org",
      "has_usable_password": true,
      "username": "wizard",
      "has_validated_password": true
    },
    "methods": [
      {
        "at": 1711555057.065702,
        "email": "email@domain.org",
        "username": "wizard"
      }
    ]
  },
  "meta": {
    "session_token": "ufwcig0zen9skyd545jc0fkq813ghar2",
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW"
  }
}

Changes

  • v2b147245b3d11Revision changes
    • info

      added the required property // to the response with the status