---
title: "Select a two-factor method"
method: POST
path: "/tf-select"
---

# Select a two-factor method

`POST /tf-select`

## Request body

- object
  - `which` string — Which two-factor method to use.

## Response `200`

Second factor select response.

- union
  - object — The user requires two-factor authorization and has chosen which one to use.
    - `meta` object, required
      - `code` integer, required — Http status code
    - `response` object, required
      - `tf_required` boolean — Will be True since a second factor is required.
      - `tf_state` string — if "setup_from_login" then the caller must go through two-factor setup endpoint. If "ready" then a code has been sent and should be supplied to SECURITY_TWO_FACTOR_TOKEN_VALIDATION_URL.
      - `tf_method` string — Which method was used to send code/link.
  - object — The user requires two-factor authorization and has chosen to use `webauthn`.
    - `meta` object, required
      - `code` integer, required — Http status code
    - `response` object, required
      - `tf_required` boolean — Will be True since a second factor is required.
      - `tf_state` string — This will be set to `ready`.
      - `tf_method` string — This will be set to `webauthn`.
      - `tf_signin_url` string — The value of SECURITY_WAN_SIGNIN_URL

## Other responses

- `302` — User selected which two-factor to use when using form based request.
- `400` — Errors while validating attributes.

## Changes

- **2023-10-22** `b647a0e917e6` — 2 breaking, 5 info
  - the response's body type/format changed from ``/`` to `object`/`` for status `400`
  - added `subschema #1, subschema #2` to the `allOf[subschema #1 -> subschema #2]/` response property `oneOf` list for the response status `200` (media type: application/json)
  - added `#/components/schemas/BaseJsonResponse` to the response body `allOf` list for the response status `200` (media type: application/json)
  - removed `#/components/schemas/BaseJsonResponse, subschema #2` from the response body `allOf` list for the response status `400`
  - …3 more
- **2022-07-22** `4b3ea48a957a` — 1 breaking, 2 warning, 2 info
  - the `allOf[subschema #2]/response/errors` response's property type/format changed from `object`/`` to `array`/`` for status `400`
  - removed the optional property `allOf[subschema #2]/response/error` from the response with the `400` status
  - removed the optional property `allOf[subschema #2]/response/errors/field-name` from the response with the `400` status
  - added the optional property `allOf[subschema #2]/response/field_errors` to the response with the `400` status
  - …1 more
- **2022-04-11** `afed188e0556` — 1 info
  - endpoint added
- **2019-07-23** `11c8459a5c04` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/pallets-eco/apis/flask-security-external-api/changes/tf-select/post.md)

---

[API](https://skmtc.dev/pallets-eco/apis/flask-security-external-api.md) · [All operations](https://skmtc.dev/pallets-eco/apis/flask-security-external-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/pallets-eco/flask-security-external-api/revisions/ee92f388dafa/schema)