---
title: "Verify 2Fa"
method: POST
path: "/token/verify_2fa"
tags: ["token"]
---

# Verify 2Fa

`POST /token/verify_2fa`

Flows B and C: exchange a temp_2fa_token + valid TOTP code for real access/refresh tokens.

- scope=2fa_pending       -> normal 2FA-protected login (user already has 2FA enabled).
- scope=2fa_setup_required -> org-forced setup; on success also flips two_fa_enabled=True.

## Query parameters

- `redirect_url` string

## Cookies

- `temp_2fa_token` string

## Request body

- Verify2FARequest
  - `token` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/rowansci/apis/eyrie.md) · [All operations](https://skmtc.dev/rowansci/apis/eyrie/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/rowansci/eyrie/revisions/f786577eede6/schema)