---
title: "Remove the caller's authenticator (TOTP)"
method: DELETE
path: "/v1/totp"
tags: ["TOTP"]
---

# Remove the caller's authenticator (TOTP)

`DELETE /v1/totp`

## Request

- Base URL: `https://identity-api.paymongo.com`
- URL: `https://identity-api.paymongo.com/v1/totp`
- Auth: HTTP bearer

Disables authenticator-app MFA for the caller by deleting the enrolled secret. Requires the account password in the request body as confirmation — there is no OTP step-up on this route, so the password is what stops a hijacked session from silently stripping MFA. No TOTP code is required, so a user who lost their device can still remove it. Idempotent once the password checks out — returns 204 whether or not an authenticator was enrolled.

## Request body

- MfaRemoveTOTPRequestEnvelopeDTO
  - `data` object
    - `attributes` MfaRemoveTOTPRequestDTO
      - `current_password` string, required

## Response `204`

No Content

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `422`: Unprocessable Entity
- `500`: Internal Server Error

---

[API](https://skmtc.dev/paymongo/apis/identity.md) - [All operations](https://skmtc.dev/paymongo/apis/identity/llms.txt) - [OpenAPI document](https://skmtc.dev/paymongo/apis/identity/revisions/cc3056164874?raw)