Public

Complete login when user has two-factor authentication enabled.

Call this after POST /api/v1/tokens returns two_factor_required. Post the challenge token from that response together with the user's one-time code (the emailed code, or the current code from their authenticator app):

{ "challenge_token": "eyJ...", "code": "123456" }

On success the response is 200 with the final access token, in the same shape as POST /api/v1/tokens:

{ "access_token": "eyJ...", "refresh_token": "...", "token_type": "Bearer", "expires_in": 31536000 }

An incorrect code returns 400 (invalid_grant). A code has at most five attempts before the challenge locks. An expired challenge returns 410 (challenge_expired) — restart at POST /api/v1/tokens. The endpoint is rate limited to 10 requests per minute (429).

post/api/v1/tokens/two-factor

Request

  • Base URL: https://go.outseta.com
  • URL: https://go.outseta.com/api/v1/tokens/two-factor
  • Auth: none declared

Request body

challenge_tokenstring nullable

The challenge_token returned by POST /api/v1/tokens when two-factor authentication is required. Echo it back verbatim.

codestring nullable

The user's one-time code: the emailed code for an Email challenge, or the current code from their authenticator app for a Totp challenge.

Response

The code was accepted; the access token (JWT) is returned.

access_tokenstring nullable
authentication_callback_urlstring nullable
expires_ininteger
id_tokenstring nullable
refresh_tokenstring nullable
token_typestring nullable

Example response

{
  "access_token": "string",
  "authentication_callback_url": "string",
  "expires_in": 0,
  "id_token": "string",
  "refresh_token": "string",
  "token_type": "string"
}

Changes

No recorded changes to this operation across all 1 revision of this API.