Sign in
Authentication

Exchange a 2FA challenge ticket plus one proof for a full login payload. (Roles: none)

post/auth/2fa/verify

Request body

challenge_ticketstring required

The ticket returned by the login endpoint that was challenged.

totp_codestring
recovery_codestring
webauthn_assertionobject

The authenticator's response to the options from /auth/2fa/webauthn/login-options. Exactly one of totp_code, recovery_code or webauthn_assertion must be present.

Response

Success

tokenstring
registeredboolean
magic_link_sentboolean
magic_link_messagestring
two_factor_requiredboolean

Credentials were accepted but the account has 2FA enabled, so no token is issued. Exchange the challenge_ticket for a full payload via /auth/2fa/verify.

challenge_ticketstring

Single-use, short-lived ticket identifying the pending 2FA challenge.

two_factor_methodsstring[]

Second factors the user can present for this challenge.

Changes

Changed in 1 of the 8 revisions of this API.1