---
title: "Verify login step for multi factor authentication (MFA)."
method: POST
path: "/v3/sessions/verify/"
tags: ["sessions"]
---

# Verify login step for multi factor authentication (MFA).

`POST /v3/sessions/verify/`

## Description
To enable MFA on a Smarkets account:<br>
 - Go to <a href="https://smarkets.com/account/settings/login">login settings</a>
and click "Enable Two-Factor Authentication"<br>
 - Copy the secret into your TOTP library<br>
 - Generate one code using it and paste it in the dialog<br>
 - Click "Enable Two-Factor Authentication"<br>

Every time you login: <br>
 - Make a POST request to /v3/sessions/ to get a token<br>
 - Make a POST request to this route with the token and the code
generated by you to complete the login<br>

## Request body

- object
  - `code` string, required — This code is generated as a time based one-time password (TOTP)
  - `token` string, nullable, required — This session token can be used to make authenticated requests to Smarkets.<br> We will resolve the who the user is based on this.<br> Account information, orders, up-to-date prices are examples that will require it to be sent.

## Response `201`

Token response for old and new auth v2.

- union — Token response for old and new auth v2.
  - object — Token response
    - `created_social_member` boolean
    - `factor` 'complete' | 'totp' | 'nemid' — Next factor for authentication to complete, used in multi factor authentication: <ul> <li>complete: Login is complete and there is no further factor required. <li>totp: Login is incomplete and needs the totp code. <li>nemid: Login is incomplete and needs nemid confirmation.<li> </ul>
    - `nemid_session_id` string — Session id for Denmark nemid authorization
    - `redirect_url` string — Redirect url to complete nemid authorization flow
    - `stop` string, date-time, nullable, required — This datetime specifies when the token will expire if not renewed.<br> Any authenticated API call will automatically renew the token for another 30min<br>
    - `token` string, nullable, required — This session token can be used to make authenticated requests to Smarkets.<br> We will resolve the who the user is based on this.<br> Account information, orders, up-to-date prices are examples that will require it to be sent.
    - `verify` boolean — True if further verification is required
  - object — Token response for auth v2
    - `created_social_member` boolean
    - `factor` 'complete' | 'totp' | 'nemid' — Next factor for authentication to complete, used in multi factor authentication: <ul> <li>complete: Login is complete and there is no further factor required. <li>totp: Login is incomplete and needs the totp code. <li>nemid: Login is incomplete and needs nemid confirmation.<li> </ul>
    - `refresh_token` string, required — This refresh token can be used to generate an access token.
    - `stop` string, date-time, nullable, required — This datetime specifies when the token will expire if not renewed.<br> Any authenticated API call will automatically renew the token for another 30min<br>
    - `token` string, required — This Access token can be used to make authenticated requests to Smarkets.<br> We will resolve the who the user is based on this.<br> Account information, orders, up-to-date prices are examples that will require it to be sent.
    - `verify` boolean — True if further verification is required

## Other responses

- `400` — INVALID_TOKEN, REQUEST_VALIDATION_ERROR
- `401` — INVALID_CREDENTIALS, PASSWORD_RESET_NEEDED
- `403` — USER_SELF_SUSPENDED, SOURCE_BLOCKED, USER_SUSPENDED, USER_ON_TIMEOUT, SESSION_LIMIT_REACHED, USER_EXCLUDED, CLIENT_JURISDICTION_MISMATCH, IP_NOT_TRUSTED, LOGIN_VERIFICATION_REQUIRED
- `429` — Rate limit exceeded
- `451` — COUNTRY_BLOCKED
- `500` — Internal server error
- `503` — AUTH_UNAVAILABLE, TIMEOUT

---

[API](https://skmtc.dev/smarkets/apis/smarkets-http-api.md) · [All operations](https://skmtc.dev/smarkets/apis/smarkets-http-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/smarkets/smarkets-http-api/revisions/75f7e3050340/schema)