---
title: "Verify TOTP code"
method: POST
path: "/auth/2fa/verify"
tags: ["Auth"]
---

# Verify TOTP code

`POST /auth/2fa/verify`

## Request

- Base URL: `https://orbitus.netcorecloud.com`
- URL: `https://orbitus.netcorecloud.com/auth/2fa/verify`
- Auth: none required

Verify a TOTP code. Used for both setup confirmation (`setup: true`) and login
verification. When `setup: true`, returns backup codes. During login, returns the
full login response.

## Request body

- TwoFactorVerifyRequest
  - `user_id` integer, required
  - `client_id` integer, required
  - `code` string, required: 6-digit TOTP code.
  - `setup` boolean: Set to `true` during initial 2FA setup confirmation.

## Response `200`

Verification successful.

- union
  - TwoFactorSetupConfirmResponse
    - `success` boolean
    - `backup_codes` string[]: One-time backup codes; store securely.
  - LoginResponse
    - `token` string: JWT access token (15-minute lifetime).
    - `refresh_token` string: Refresh token (7-day lifetime).
    - `refresh_expires_at` string, date-time
    - `client_id` integer
    - `clients` ClientSummary[]
      - `client_id` integer
      - `clientname` string
      - `status` 'active' | 'inactive'
    - `is_parent` boolean
    - `user` UserProfile
      - `id` integer
      - `username` string
      - `email` string, email
      - `full_name` string
      - `role` 'admin' | 'viewer'
      - `client_id` integer
      - `two_factor_enabled` boolean

---

[API](https://skmtc.dev/netcorecloud/apis/orbit-router.md) - [All operations](https://skmtc.dev/netcorecloud/apis/orbit-router/llms.txt) - [OpenAPI document](https://skmtc.dev/netcorecloud/apis/orbit-router/revisions/680f0a8ab1a3?raw)