Complete installation-bound native MFA

POST/api/v1/mobile/auth/mfa/verify

First-party native email/password authentication. No browser, callback, cookies, client secret or platform-store registration is involved. Use the fixed client matching the platform and the installation binding. Core preserves password policy, account state, rate limits and MFA. Login returns mfa_required=true with a five-minute, five-attempt challenge when enrolled; no credential is issued before verification. Native MFA challenges cannot be redeemed by browser MFA or another installation. Registration creates an unverified account and sends verification email; verification gates recovery, not access. A verification_delivery_failed response means the account exists; request another email and log in. Passwords and challenges are memory-only; never log or automatically retry.

Request Body

application/json

client_idRequired

string

Values

assign-iosassign-android

platformRequired

string

Values

iosandroid

installation_idRequired

string <password>·min 43·max 128

device_labelRequired

string·min 1·max 64

mfa_tokenRequired

string·min 1·max 512

A single-use, expiring bearer secret delivered by email. Only its hash is stored, so it cannot be recovered from a database disclosure. Treat it as a credential: never log it or place it in a URL you retain.

codeRequired

string <password>·min 1·max 64

Either a six-digit TOTP code or one of the account's recovery codes. Recovery codes are matched after stripping spaces and hyphens and upper-casing, so a code read off paper matches however it was grouped.

Responses

Authentication · Conventions and errors · API guides · Resource reference

Complete installation-bound native MFA