---
title: "Confirm TOTP enrollment"
method: POST
path: "/v1/totp/enroll/confirm"
tags: ["TOTP"]
---

# Confirm TOTP enrollment

`POST /v1/totp/enroll/confirm`

## Request

- Base URL: `https://identity-api.paymongo.com`
- URL: `https://identity-api.paymongo.com/v1/totp/enroll/confirm`
- Auth: HTTP bearer

Completes enrollment by validating a code from the authenticator paired at /v1/totp/enroll. Once confirmed, the authenticator can satisfy step-up actions via /v1/challenges/verify with factor "totp". Returns a fresh set of single-use recovery codes, which REPLACES any previous set and is shown here exactly once — only hashes are stored, so the client must display them to the user immediately. Each code can satisfy login's second factor once, via /v1/auth with factor "recovery_code"; using one removes the authenticator. Too many wrong codes returns 429 with Retry-After; that throttle is scoped to enrollment and does not affect login.

## Request body

- MfaConfirmTOTPRequestEnvelopeDTO
  - `data` object
    - `attributes` MfaConfirmTOTPRequestDTO
      - `code` string, required

## Response `200`

OK

- object: Standard response containing data and its metadata if any
  - `data` object
    - `attributes` MfaConfirmTOTPAttributesDTO
      - `recovery_codes` string[]
    - `id` string
    - `type` string
  - `has_more` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `422`: Unprocessable Entity
- `429`: Too Many Requests
- `500`: Internal Server Error

---

[API](https://skmtc.dev/paymongo/apis/identity.md) - [All operations](https://skmtc.dev/paymongo/apis/identity/llms.txt) - [OpenAPI document](https://skmtc.dev/paymongo/apis/identity/revisions/cc3056164874?raw)