Sign in
Authentication (Allauth Headless)

Reauthenticate using 2FA

Changed on

In order to safeguard the account, some actions require the user to be recently authenticated. If you try to perform such an action without having been recently authenticated, a 401 status is returned, listing flows that can be performed to reauthenticate. One such flow is the flow with ID mfa_reauthenticate, which allows for the user to input an authenticator code (e.g. TOTP or recovery code). This is the endpoint related towards that flow.

post/api/v2/allauth/browser/v1/auth/2fa/reauthenticate

Request

  • The document declares no server URL.
  • Auth: none declared

Path parameters

client'app' | 'browser' required

The type of client accessing the API.

Headers

X-Session-Tokenstring

Session token. Only needed when client is equal to app.

Request body

codestring required

An authenticator code.

Example request

{
  "code": "314159"
}

Response

Authenticated by password and 2FA.

status200 required

Example response

{
  "data": {
    "user": {
      "id": 123,
      "display": "Magic Wizard",
      "email": "email@domain.org",
      "has_usable_password": true,
      "username": "wizard",
      "has_validated_password": true
    },
    "methods": [
      {
        "at": 1711555057.065702,
        "email": "email@domain.org",
        "username": "wizard"
      }
    ]
  },
  "meta": {
    "session_token": "ufwcig0zen9skyd545jc0fkq813ghar2",
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW"
  }
}

Changes

  • v2b147245b3d11Revision changes
    • info

      added the required property // to the response with the status