Auth

Verify Login

Exchange the 5-minute mfa_challenge_token (returned by /login when the user has active MFA) for a real session JWT.

Three method values are accepted:

  • totp: standard 6-digit code from the authenticator app. Issues a full session token (mfa_satisfied=true, mfa_recovery=false).
  • webauthn: webauthn_response carries the JSON object the browser produced from navigator.credentials.get (after the separate /login/webauthn/begin call). Same outcome as totp on success.
  • recovery_code: one of the 8-char XXXX-XXXX codes generated at enrolment. Single-use. Issues a restricted session (mfa_satisfied=true, mfa_recovery=true) — the get_admin_user dependency rejects this token on every extranet route, forcing the user through /account/security to enrol a fresh method before resuming work.
post/auth/mfa/verify-login

Request

  • Base URL: http://localhost:8000
  • URL: http://localhost:8000/auth/mfa/verify-login
  • Auth: none declared

Headers

API-Version'1'

Major API version. Omit or send 1 for the current v1 surface. Retired operations use RFC 9745 Deprecation and RFC 8594 Sunset headers.

Request body

mfa_challenge_tokenstring required
codestring
method'totp' | 'webauthn' | 'recovery_code'
webauthn_responseobject nullable

Response

Successful Response

idinteger required
usernamestring email required
firstnamestring nullable
lastnamestring nullable
displaynamestring nullable
phonestring nullable
register_datestring date-time required
profile_picstring required
access_tokenstring nullable
pending_emailstring nullable
mfa_satisfiedboolean
mfa_enrolledboolean
mfa_recoveryboolean
mfa_access_requiredboolean

Changes

No recorded changes to this operation across all 1 revision of this API.