---
title: "Complete MFA login"
method: POST
path: "/auth/mfa/login"
tags: ["Authentication"]
---

# Complete MFA login

`POST /auth/mfa/login`

## Request

- Base URL: `https://saturnsql.com/api`
- URL: `https://saturnsql.com/api/auth/mfa/login`
- Auth: none required

Completes a login challenged by MFA: submit the short-lived `mfaToken` from POST /auth/login plus the 6-digit TOTP `code` (or a backup code).

## Request body

- object
  - `mfaToken` string, required
  - `code` string, required

## Response `200`

Authenticated

- AuthSession: A successful authentication: session token plus the signed-in user and their companies.
  - `token` string, required: JWT session token (24h). Send as `Authorization: Bearer <token>`.
  - `refreshToken` string, required: Long-lived refresh token (30d) for POST /auth/refresh.
  - `selectedCompanyId` string
  - `mustChangePassword` boolean
  - `user` object
    - `id` string
    - `email` string
    - `name` string
  - `companies` object[]
    - `id` string
    - `name` string
    - `plan` string

## Other responses

- `400`: Validation failed
- `401`: Bad or missing credentials

---

[API](https://skmtc.dev/saturnsql/apis/saturnsql-api.md) · [All operations](https://skmtc.dev/saturnsql/apis/saturnsql-api/llms.txt) · [OpenAPI document](https://skmtc.dev/saturnsql/apis/saturnsql-api/revisions/90a3e54ad115?raw)