---
title: "Turn two-factor authentication off. Requires a step-up proof. (Roles: user)"
method: POST
path: "/auth/2fa/disable"
tags: ["Authentication"]
---

# Turn two-factor authentication off. Requires a step-up proof. (Roles: user)

`POST /auth/2fa/disable`

## Request body

- TwoFactorStepUpPayload — A fresh second-factor proof for a change to the second factors themselves. Exactly one field; an empty body is answered with error_payload.code STEP_UP_REQUIRED.
  - `totp_code` string
  - `recovery_code` string
  - `webauthn_assertion` object

## Response `200`

Success

- TwoFactorDisableResponse
  - `token` string — Fresh token; disabling revokes every existing session.

## Other responses

- `400` — Error
- `429` — Too many failed second-factor attempts

## Changes

- **2026-09-01** `37a21589e770` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ludo/apis/ludo-ai-api/changes/auth/2fa/disable/post.md)

---

[API](https://skmtc.dev/ludo/apis/ludo-ai-api.md) · [All operations](https://skmtc.dev/ludo/apis/ludo-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ludo/ludo-ai-api/revisions/37a21589e770/schema)