SUsupabase
user

Replace the user's MFA recovery codes with a new set.

Changed on

Atomically invalidates all existing codes, issues a fresh set and clears any active verification lockout. The new plaintext codes are returned exactly once. Requires an AAL2 session.

post/factors/recovery-codes/regenerate

Request

  • Base URL
    https://abcdefghijklmnopqrst.supabase.co/auth/v1
  • URL
    https://abcdefghijklmnopqrst.supabase.co/auth/v1/factors/recovery-codes/regenerate
  • Auth
    API key in header apikey and HTTP bearer

Response

Recovery codes were regenerated. Show the codes to the user now; they cannot be retrieved again and the previous codes no longer work.

idstring uuid

ID of the user's recovery_code factor.

typestring

Always recovery_code.

friendly_namestring
totalinteger

Number of codes in the set.

codesstring[]

The plaintext single-use codes in canonical form (16 characters by default). Show them to the user once.

Example response

{
  "friendly_name": "Recovery codes",
  "total": 10,
  "codes": [
    "k4m9x7qp2ab8ht3z"
  ]
}

Changes