---
title: "Revoke the user's MFA recovery codes."
method: DELETE
path: "/factors/recovery-codes"
tags: ["user"]
---

# Revoke the user's MFA recovery codes.

`DELETE /factors/recovery-codes`

## Request

- Base URL: `https://abcdefghijklmnopqrst.supabase.co/auth/v1`
- URL: `https://abcdefghijklmnopqrst.supabase.co/auth/v1/factors/recovery-codes`
- Auth: API key in header `apikey` and HTTP bearer

Removes the recovery-code factor and all of its codes. Sessions that reached AAL2 with a recovery code are downgraded to AAL1. Requires an AAL2 session. Works regardless of whether recovery-code enrollment or verification is enabled on the server.

## Response `200`

The recovery-code factor was removed.

- object
  - `id` string, uuid

## Other responses

- `403`: Forbidden error. Requires an AAL2 session; anonymous users cannot use recovery codes.
- `404`: The user has not enrolled recovery codes.

## Changes

- **2026-09-21** `2e2206095d36`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/changes/factors/recovery-codes/delete.md)

---

[API](https://skmtc.dev/supabase/apis/supabase-auth-rest-api.md) - [All operations](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/revisions/c480c2703e65?raw)