---
title: "Get the status of the user's MFA recovery codes."
method: GET
path: "/factors/recovery-codes"
tags: ["user"]
---

# Get the status of the user's MFA recovery codes.

`GET /factors/recovery-codes`

## Request

- Base URL: `https://abcdefghijklmnopqrst.supabase.co/auth/v1`
- URL: `https://abcdefghijklmnopqrst.supabase.co/auth/v1/factors/recovery-codes`
- Auth: API key in header `apikey` and HTTP bearer

Returns the recovery-code factor ID together with the total number of codes and how many are still unused. Code values are never returned after generation. Works regardless of whether recovery-code enrollment or verification is enabled on the server.

## Response `200`

The user's recovery-code status.

- MFARecoveryCodesStatusSchema: Enrollment status of the user's MFA recovery codes. Never contains code values.
  - `id` string, uuid: ID of the user's `recovery_code` factor.
  - `type` string: Always `recovery_code`.
  - `total` integer: Number of codes in the current set.
  - `remaining` integer: Number of codes in the current set that have not been used yet.

## Other responses

- `403`: Forbidden error. Anonymous users cannot use recovery codes.
- `404`: The user has not enrolled recovery codes.

## Changes

- **2026-09-21** `2e2206095d36`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/changes/factors/recovery-codes/get.md)

---

[API](https://skmtc.dev/supabase/apis/supabase-auth-rest-api.md) - [All operations](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/revisions/c480c2703e65?raw)