Auth

Verify Totp

Confirm enrolment by submitting an OTP from the freshly-installed authenticator.

On success:

  • Flip the method to is_active=True.
  • First-time-only: mint a fresh batch of recovery codes (returned exactly once) and stamp users.mfa_enforced_at.
  • Mint a fresh access token with mfa_satisfied=true, mfa_recovery=false — this is what unlocks a recovery-locked session.
post/auth/mfa/verify/totp

Request

  • Base URL: http://localhost:8000
  • URL: http://localhost:8000/auth/mfa/verify/totp
  • Auth: HTTP bearer

Headers

API-Version'1'

Major API version. Omit or send 1 for the current v1 surface. Retired operations use RFC 9745 Deprecation and RFC 8594 Sunset headers.

Request body

method_idinteger required
codestring required

Response

Successful Response

method_idinteger required
access_tokenstring required
recovery_codesstring[] nullable

Changes

No recorded changes to this operation across all 1 revision of this API.