---
title: "POST /api/session/mfa/verify"
method: POST
path: "/api/session/mfa/verify"
tags: ["/api/session"]
---

# POST /api/session/mfa/verify

`POST /api/session/mfa/verify`

## Request

- Base URL: `` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/session/mfa/verify`
- Auth: API key in header `X-API-Key`

Complete a two-step login by verifying a one-time code. Takes the `challenge_token` returned by
  `POST /api/session` and either the 6-digit `code` from the user's authenticator app, one of
  their single-use recovery codes, or an emailed one-time code; on success sets the session cookie.

## Request body

- object
  - `challenge_token` string, required: value must be a non-blank string.
  - `code` string, required: value must be a non-blank string.
  - `remember` boolean

## Response `2XX`

Successful response

## Other responses

- `4XX`: Client error response
- `5XX`: Server error response

## Changes

- **2026-11-04** `2e178f5a7934`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/metabase/apis/metabase-api/changes/api/session/mfa/verify/post.md)

---

[API](https://skmtc.dev/metabase/apis/metabase-api.md) - [All operations](https://skmtc.dev/metabase/apis/metabase-api/llms.txt) - [OpenAPI document](https://skmtc.dev/metabase/apis/metabase-api/revisions/2e178f5a7934?raw)