---
title: "Verify MFA PIN"
method: POST
path: "/api/auth/pin/verify"
tags: ["Authentication"]
---

# Verify MFA PIN

`POST /api/auth/pin/verify`

## Request

- Base URL: `https://api.sponsorunited.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sponsorunited.com/api/auth/pin/verify`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/sponsorunited/apis/sponsorunited-api/docs/api/auth/pin/verify/post.ts> (a function with typed inputs; its response is checked against the schema)

Verifies the MFA PIN and returns a full authentication token. Requires the temporary JWT token from the initial login.

## Request body

- VerifyLoginRequest
  - `pin` string, required: 6-digit verification PIN

## Response `200`

Authentication successful

- LoginResource
  - `token` string, required: JWT authentication token
  - `session` string, required: Session signature
  - `mfa_enabled` boolean: Whether MFA verification is required
  - `user_id` integer: User ID (returned when MFA is enabled)
  - `has_phone` boolean: Whether user has phone number for SMS MFA
  - `force_new_password` integer: Whether user must reset password
  - `reset_token` string: Password reset token (when force_new_password is set)

## Other responses

- `401`: User not authorized
- `429`: Invalid or expired PIN / Maximum attempts reached

---

[API](https://skmtc.dev/sponsorunited/apis/sponsorunited-api.md) - [All operations](https://skmtc.dev/sponsorunited/apis/sponsorunited-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sponsorunited/apis/sponsorunited-api/revisions/cbf1ca5bff8f?raw)