Complete two-phase login with a TOTP or recovery code

Phase 2 of login for accounts with TOTP enrolled: consumes the totp_token returned by POST /auth/login's totp_required response, verifies a 6-digit TOTP code (or a recovery code), and on success rotates and sets the yp_session cookie, returning the same bootstrap payload as GET /me. The token is single-use and expires 5 minutes after phase 1; a wrong code does not burn it, but each code (TOTP step or recovery code) can only ever be consumed once. Limited to 10 login attempts per IP per minute plus 5 code attempts per user per minute.

post/auth/login/totp

Request

  • Base URL: https://app.yoping.me/api/v1
  • URL: https://app.yoping.me/api/v1/auth/login/totp
  • Auth: none required

Request body

totp_tokenstring required

The token returned as totp_token by POST /auth/login's phase-1 totp_required response.

codestring required

A 6-digit TOTP code from the enrolled authenticator, or an unused recovery code.

Response

Logged in; the session cookie is set and the /me bootstrap payload is returned.

Changes

No recorded changes to this operation across all 1 revision of this API.