Turn off the authenticator app
curl --request DELETE \
--url https://my.server.express/api/v1/auth/2fa/totp \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"password": "<string>",
"code": "<string>"
}
'const options = {
method: 'DELETE',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({password: '<string>', code: '<string>'})
};
fetch('https://my.server.express/api/v1/auth/2fa/totp', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://my.server.express/api/v1/auth/2fa/totp"
payload = {
"password": "<string>",
"code": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.delete(url, json=payload, headers=headers)
print(response.text){
"success": true,
"message": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}Auth
Turn off the authenticator app
Removes the authenticator and every backup code. Costs a fresh proof: either the account password or a current code (TOTP or backup). The code path exists for Google/Discord accounts, which have a random password nobody knows. If both are sent, only the password is checked. A wrong proof is 403. Passkeys are untouched. Rate-limited to 10 requests per 15 minutes per IP. Writes a DISABLE_TOTP audit entry.
DELETE
/
v1
/
auth
/
2fa
/
totp
Turn off the authenticator app
curl --request DELETE \
--url https://my.server.express/api/v1/auth/2fa/totp \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"password": "<string>",
"code": "<string>"
}
'const options = {
method: 'DELETE',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({password: '<string>', code: '<string>'})
};
fetch('https://my.server.express/api/v1/auth/2fa/totp', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://my.server.express/api/v1/auth/2fa/totp"
payload = {
"password": "<string>",
"code": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.delete(url, json=payload, headers=headers)
print(response.text){
"success": true,
"message": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}Authorizations
Session access token (JWT) from POST /v1/auth/login or /v1/auth/refresh. A session satisfies every API scope.
Body
application/json