Finish sign-in with an authenticator or backup code
curl --request POST \
--url https://my.server.express/api/v1/auth/2fa/code \
--header 'Content-Type: application/json' \
--data '
{
"preAuthToken": "<string>",
"code": "<string>"
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({preAuthToken: '<string>', code: '<string>'})
};
fetch('https://my.server.express/api/v1/auth/2fa/code', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://my.server.express/api/v1/auth/2fa/code"
payload = {
"preAuthToken": "<string>",
"code": "<string>"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"accessToken": "<string>",
"refreshToken": "<string>",
"user": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"email": "[email protected]",
"firstName": "<string>",
"lastName": "<string>",
"role": "CLIENT"
},
"backupCodesRemaining": 1
}
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}Auth
Finish sign-in with an authenticator or backup code
Completes a sign-in that stopped at the second factor. Takes a six-digit TOTP code or a 10-character backup code (with or without the hyphen) — the server tells them apart by length. A TOTP code can’t be replayed and a backup code is spent on use; when one is, backupCodesRemaining tells you how many are left. A wrong code is 403, not 401, so the portal doesn’t read it as a dead session. An expired pre-auth token is 400. Rate-limited to 10 requests per 15 minutes per IP. Writes LOGIN_TOTP, LOGIN_BACKUP_CODE or LOGIN_2FA_FAILED audit entries.
POST
/
v1
/
auth
/
2fa
/
code
Finish sign-in with an authenticator or backup code
curl --request POST \
--url https://my.server.express/api/v1/auth/2fa/code \
--header 'Content-Type: application/json' \
--data '
{
"preAuthToken": "<string>",
"code": "<string>"
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({preAuthToken: '<string>', code: '<string>'})
};
fetch('https://my.server.express/api/v1/auth/2fa/code', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://my.server.express/api/v1/auth/2fa/code"
payload = {
"preAuthToken": "<string>",
"code": "<string>"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"accessToken": "<string>",
"refreshToken": "<string>",
"user": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"email": "[email protected]",
"firstName": "<string>",
"lastName": "<string>",
"role": "CLIENT"
},
"backupCodesRemaining": 1
}
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}Body
application/json