---
title: "Google Mfa"
method: POST
path: "/api/v1/auth/google/mfa"
tags: ["auth"]
---

# Google Mfa

`POST /api/v1/auth/google/mfa`

## Request

- Base URL: `https://api.nudgelink.co` (the document declares no server; this is the origin it was published from)
- URL: `https://api.nudgelink.co/api/v1/auth/google/mfa`
- Auth: none declared

Finish a Google sign-in for a 2FA account: challenge + authenticator code.

Brute force is bounded per challenge (``_MFA_MAX_ATTEMPTS`` wrong codes and
it is deleted), per account and per network across challenges
(``_MFA_MAX_FAILURES_PER_*`` wrong codes lock this step for
``_MFA_LOCK_SECONDS``), and a code that already signed in is refused. No
``@limiter.limit`` here: this module has ``from __future__ import
annotations`` (the PEP 563 + slowapi hazard).

## Request body

- GoogleMfaRequest
  - `challenge` string, required
  - `totp_code` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/nudgelink/apis/nudgelink-api.md) · [All operations](https://skmtc.dev/nudgelink/apis/nudgelink-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nudgelink/apis/nudgelink-api/revisions/baa46e6db986?raw)