SUsupabase
user

Generate the user's one-time set of MFA recovery codes.

Changed on

Creates a verified recovery_code factor together with a set of single-use codes. The plaintext codes are returned exactly once, in canonical form. Requires an AAL2 session and at least one other verified factor, because recovery codes can never be the user's only second factor. Use POST /factors/recovery-codes/regenerate to rotate an existing set.

post/factors/recovery-codes

Request

  • Base URL
    https://abcdefghijklmnopqrst.supabase.co/auth/v1
  • URL
    https://abcdefghijklmnopqrst.supabase.co/auth/v1/factors/recovery-codes
  • Auth
    API key in header apikey and HTTP bearer

Request body

friendly_namestring

Name shown in the user's factor list. Subject to the same per-user uniqueness rule as any other factor. Defaults to Recovery codes when omitted or blank.

Response

Recovery codes were generated. Show the codes to the user now; they cannot be retrieved again.

idstring uuid

ID of the user's recovery_code factor.

typestring

Always recovery_code.

friendly_namestring
totalinteger

Number of codes in the set.

codesstring[]

The plaintext single-use codes in canonical form (16 characters by default). Show them to the user once.

Example response

{
  "friendly_name": "Recovery codes",
  "total": 10,
  "codes": [
    "k4m9x7qp2ab8ht3z"
  ]
}

Changes