---
title: "Generate MFA recovery codes"
method: POST
path: "/v1/auth/mfa/recovery-codes/generate"
tags: ["MFA"]
---

# Generate MFA recovery codes

`POST /v1/auth/mfa/recovery-codes/generate`

Generates 10 one-time recovery codes for the authenticated user. Any previously issued codes are invalidated. Plaintext codes are returned exactly once; the server stores only bcrypt hashes.

## Response `200`

Recovery codes generated

- MfaRecoveryCodesResponse
  - `codes` string[]

## Other responses

- `401` — Unauthenticated
- `500` — Internal server error

---

[API](https://skmtc.dev/timesheet/apis/timesheet-api.md) · [All operations](https://skmtc.dev/timesheet/apis/timesheet-api/llms.txt) · [OpenAPI document](https://skmtc.dev/timesheet/apis/timesheet-api/revisions/a3d2f44e7345?raw)