Public

Complete login with a two-factor recovery code.

A fallback for users who cannot produce their primary code but still have a recovery code on file (see recovery_codes_available on the login response). Post the challenge token together with one recovery code:

{ "challenge_token": "eyJ...", "recovery_code": "abcd-efgh-ijkl" }

On success the response is 200 with the final access token, in the same shape as POST /api/v1/tokens. Each recovery code is single-use. An incorrect code returns 400 (invalid_grant); an expired challenge returns 410 (challenge_expired). Rate limited to 10 requests per minute (429).

Used by the embed login widget; the hosted Razor flow has its own equivalent action on the AuthenticationController.

post/api/v1/tokens/two-factor/recovery

Request

  • Base URL: https://go.outseta.com
  • URL: https://go.outseta.com/api/v1/tokens/two-factor/recovery
  • Auth: none declared

Query parameters

dataunknown required

Response

The recovery code was accepted; the access token (JWT) is returned.

access_tokenstring nullable
authentication_callback_urlstring nullable
expires_ininteger
id_tokenstring nullable
refresh_tokenstring nullable
token_typestring nullable

Example response

{
  "access_token": "string",
  "authentication_callback_url": "string",
  "expires_in": 0,
  "id_token": "string",
  "refresh_token": "string",
  "token_type": "string"
}

Changes

No recorded changes to this operation across all 1 revision of this API.