---
title: "Replace the user's MFA recovery codes with a new set."
method: POST
path: "/factors/recovery-codes/regenerate"
tags: ["user"]
---

# Replace the user's MFA recovery codes with a new set.

`POST /factors/recovery-codes/regenerate`

## Request

- Base URL: `https://abcdefghijklmnopqrst.supabase.co/auth/v1`
- URL: `https://abcdefghijklmnopqrst.supabase.co/auth/v1/factors/recovery-codes/regenerate`
- Auth: API key in header `apikey` and HTTP bearer

Atomically invalidates all existing codes, issues a fresh set and clears any active verification lockout. The new plaintext codes are returned exactly once. Requires an AAL2 session.

## Response `200`

Recovery codes were regenerated. Show the `codes` to the user now; they cannot be retrieved again and the previous codes no longer work.

- MFARecoveryCodesSchema: A freshly generated set of MFA recovery codes. Returned only by `POST /factors/recovery-codes` and `POST /factors/recovery-codes/regenerate`; the codes cannot be retrieved afterwards.
  - `id` string, uuid: ID of the user's `recovery_code` factor.
  - `type` string: Always `recovery_code`.
  - `friendly_name` string
  - `total` integer: Number of codes in the set.
  - `codes` string[]: The plaintext single-use codes in canonical form (16 characters by default). Show them to the user once.

## Other responses

- `403`: Forbidden error. Requires an AAL2 session; anonymous users cannot use recovery codes.
- `404`: The user has not enrolled recovery codes.
- `422`: Unprocessable entity. Recovery-code enrollment is disabled on the server.

## Changes

- **2026-09-21** `2e2206095d36`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/changes/factors/recovery-codes/regenerate/post.md)

---

[API](https://skmtc.dev/supabase/apis/supabase-auth-rest-api.md) - [All operations](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/revisions/c480c2703e65?raw)