---
title: "Completes a sign-in that requires two-factor authentication."
method: POST
path: "/api/auth/2fa/verify"
tags: ["auth"]
---

# Completes a sign-in that requires two-factor authentication.

`POST /api/auth/2fa/verify`

## Request

- Base URL: `https://api.pricklymails.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.pricklymails.com/api/auth/2fa/verify`
- Auth: none declared

## Request body

- Verify2FARequest: Request body for `POST /api/auth/2fa/verify`.
  - `code` string, required: The TOTP code or backup code.
  - `temp_token` string, required: The `temp_token` returned by login when 2FA is required.

## Response `200`

2FA verified; authenticated.

- AuthResponse: Response body for authentication endpoints.
  - `access_token` string, required: Access token (JWT), sent as a Bearer credential.
  - `expires_in` integer, required: Access token lifetime in seconds.
  - `user` UserResponse, required: Public representation of a user.
    - `created_at` string, required: Account creation timestamp (ISO 8601).
    - `email` string, required: Email address.
    - `email_verified` boolean, required: Whether the email has been verified.
    - `locale` string, required: Language of the account's emails (`"en"` or `"fr"`).
    - `role` string, required: User role (`"user"` or `"admin"`).
    - `uuid` string, required: Public UUID.

## Other responses

- `401`: Temp token invalid, or the TOTP/backup code is wrong.
- `429`: Too many failed 2FA attempts; temporarily locked.

---

[API](https://skmtc.dev/pricklymails/apis/pricklymails-api.md) · [All operations](https://skmtc.dev/pricklymails/apis/pricklymails-api/llms.txt) · [OpenAPI document](https://skmtc.dev/pricklymails/apis/pricklymails-api/revisions/b4225a92d8fb?raw)