Complete the MFA login step
POST/api/auth/mfa/verify
Exchanges the short-lived MFA challenge token returned by POST /api/auth/login (when an account has MFA enabled) for a full access and refresh token pair. Supply either a 6-digit TOTP code or a single-use backup code. This route does not use normal bearer authentication; the mfaToken is audience-isolated and cannot authenticate any other endpoint. The challenge token is single-use: a successful verify consumes it, so it cannot be replayed for a second session. A TOTP code is likewise accepted only once (the code's time-step is recorded), and verify failures count towards the same per-account lockout as password login, so the account is locked after repeated failures regardless of source IP.
Request
Responses
- 200
- 400
- 401
- 429
- 500
MFA verified; tokens issued. Same payload as a normal login.
Validation error (missing both code types, or malformed code)
Invalid or expired MFA challenge (including a spent challenge), invalid MFA code, the account is locked after too many failed attempts, or the account was disabled by an admin since the challenge was issued ("Account is disabled").
Too many MFA verification attempts, please try again later
Server error