---
title: "Disables two-factor authentication."
method: POST
path: "/api/users/me/2fa/disable"
tags: ["account"]
---

# Disables two-factor authentication.

`POST /api/users/me/2fa/disable`

## Request

- Base URL: `https://api.pricklymails.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.pricklymails.com/api/users/me/2fa/disable`
- Auth: HTTP bearer

## Request body

- Disable2FARequest: Request body for `POST /api/users/me/2fa/disable`.
  - `code` string, required: A valid TOTP code or backup code, proving possession of the second factor.
  - `password` string, required: The user's password for confirmation.

## Response `204`

2FA disabled.

## Other responses

- `400`: Wrong password, invalid code, or 2FA not enabled.
- `401`: Missing or invalid JWT.
- `404`: No user found for the caller.
- `429`: Too many failed 2FA attempts; temporarily locked.

---

[API](https://skmtc.dev/pricklymails/apis/pricklymails-api.md) · [All operations](https://skmtc.dev/pricklymails/apis/pricklymails-api/llms.txt) · [OpenAPI document](https://skmtc.dev/pricklymails/apis/pricklymails-api/revisions/b4225a92d8fb?raw)