Complete a sign-in with a second factor
Complete a sign-in with a second factor
/api/v1/auth/mfa/verifyExchanges the challenge from login and a code for a browser session.
This is the only place a challenge becomes a session; a challenge on
its own reads nothing.
The code may be a TOTP code or one of the account's recovery codes. Recovery codes are matched ignoring spacing and case, and each is accepted exactly once.
A code is refused identically whether it was a wrong TOTP value, an unrecognized recovery code, or one already spent — telling them apart would report which factors the account actually has. A TOTP code is also refused on its second use, so a code observed in transit is not replayable for the rest of its window.
The challenge counts its own attempts and gives up after five, because
a six-digit code is reachable by brute force within the challenge
lifetime if it never does. An exhausted or expired challenge returns
401 invalid_challenge, and the caller must sign in again.
Request Body
application/jsonstring <password>·min 1·max 64Either a six-digit TOTP code or one of the account's recovery codes. Recovery codes are matched after stripping spaces and hyphens and upper-casing, so a code read off paper matches however it was grouped.
booleanWhether to remember this device; use the value chosen at the first sign-in step. true (the default when omitted,
which preserves earlier client behavior) issues a persistent
session cookie with the 7-day idle and 30-day absolute lifetimes.
false issues a browser-session cookie that the browser discards
when it closes, and the server bounds the session to 48 hours,
idle and absolute.
Responses
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <email>·min 3·max 320Normalized to lowercase and trimmed before storage and comparison.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
integer·min 1Seconds until the client may retry.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.