logo
MFAComplete MFA step-up after login
MFA

Complete MFA step-up after login

Uses the slugbase.mfa_pending cookie from password login or OIDC redirect (not the access JWT). On success, clears the pending cookie and sets the access JWT. Strict rate limiting applies.

curl -X POST "//api/auth/mfa/verify" \
  -H "Content-Type: application/json" \
  -d '{
  "code": "example_string"
}'
{
  "id": "example_string",
  "email": "user@example.com",
  "name": "John Doe",
  "user_key": "example_string",
  "is_admin": true,
  "email_verified": true,
  "language": "example_string",
  "theme": "example_string"
}
POST
/api/auth/mfa/verify
POST
Content-Typestring
Required

The media type of the request body

Options: application/json
codestring
Required

6-digit TOTP or a 16-character lowercase hex backup code

Request Preview
Response

Response will appear here after sending the request

Body

application/json
codestring
Required

6-digit TOTP or a 16-character lowercase hex backup code

Responses

idstring
emailstring
namestring
user_keystring
is_adminboolean
email_verifiedboolean
languagestring
themestring