---
title: "Confirm TOTP enrollment with a verification code"
method: POST
path: "/auth/security/totp/confirm"
tags: ["Auth"]
---

# Confirm TOTP enrollment with a verification code

`POST /auth/security/totp/confirm`

## Request

- Base URL: `https://app.openpo.st/api/v1`
- URL: `https://app.openpo.st/api/v1/auth/security/totp/confirm`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `openpost_session`

## Request body

- ConfirmTOTPSetupInputBody
  - `$schema` string, uri: A URL to the JSON Schema for this object.
  - `challenge_id` string, required: TOTP setup challenge ID
  - `code` string, required: Six digit authenticator code

## Response `200`

OK

- RecoveryCodeSetOutputBody
  - `$schema` string, uri: A URL to the JSON Schema for this object.
  - `challenge_id` string, required: Expiring challenge that activates this code set after acknowledgement
  - `recovery_codes` string[], nullable, required: One-time plaintext recovery codes; these are never returned again

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `409`: Conflict
- `422`: Unprocessable Entity
- `500`: Internal Server Error

---

[API](https://skmtc.dev/openpo/apis/openpost-api.md) · [All operations](https://skmtc.dev/openpo/apis/openpost-api/llms.txt) · [OpenAPI document](https://skmtc.dev/openpo/apis/openpost-api/revisions/67d3964458a7?raw)