---
title: "Disable two-factor authentication"
method: POST
path: "/auth/totp/disable"
---

# Disable two-factor authentication

`POST /auth/totp/disable`

## Request

- Base URL: `https://app.yoping.me/api/v1`
- URL: `https://app.yoping.me/api/v1/auth/totp/disable`
- Auth: API key in cookie `yp_session`

Turns off 2FA after proving possession of the second factor (a valid TOTP code or an unused recovery code) — a stolen session cookie alone must not be able to strip the account's protection. Clears the secret and deletes all recovery codes. 400 if 2FA is not enabled or the code is invalid. Shares the per-user 5 code attempts per minute limiter with setup, confirm, recovery-codes, and login phase 2.

## Request body

- TOTPDisableRequest
  - `code` string, required: A 6-digit TOTP code or an unused recovery code proving possession of the second factor.

## Response `200`

Success with a human-readable message.

- object: Uniform success envelope: the payload is always under `data`.
  - `data` MessageData, required
    - `message` string, required

## Other responses

- `400`: Invalid input (code `validation_failed`): malformed JSON, a missing or out-of-range field, bad pagination parameters, or a rejected token.
- `401`: Not authenticated (code `unauthorized`): missing, invalid, or expired session; invalid login credentials; or a Bearer token, which this surface rejects.
- `403`: Forbidden. Code `forbidden` for a cross-origin (CSRF) request blocked by origin validation or for API-key management attempted without a browser session; `account_suspended` when a suspended account attempts a mutation; `account_deleted` when an account in its deletion grace window calls a non-exempt route.
- `429`: Too many requests (code `rate_limited`). A global per-IP budget of 300 requests/minute (burst 60) applies to every endpoint; login, signup, and test alerts have tighter dedicated limits.

---

[API](https://skmtc.dev/yoping/apis/yopingme-api.md) · [All operations](https://skmtc.dev/yoping/apis/yopingme-api/llms.txt) · [OpenAPI document](https://skmtc.dev/yoping/apis/yopingme-api/revisions/76d8deb40173?raw)