Verify MFA during login

POST

/v1/auth/mfa/verify

Completes login after MFA challenge. Requires mfa_session_id (UUID from login response) and OTP code. Returns JWT access and refresh tokens on success. Invalid or expired session returns 400 INVALID_SESSION.

Authentication: none. Rate limit: auth_mfa (gateway).

Request

Body Params application/jsonRequired

Examples

Responses

🟢200

application/json

Tokens issued

Bodyapplication/json

🟠400BadRequest

🟠401Unauthorized

🟠403Forbidden

🟠404NotFound

🟠409Conflict

🔴500InternalError

Request Example

Shell

JavaScript

Java

Swift

curl --location '/v1/auth/mfa/verify' \
--header 'Content-Type: application/json' \
--data '{
    "mfa_session_id": "461e97b2-c859-4b19-98fe-554c7300bc07",
    "code": "string"
}'

Response Example

200 - Example 1

{
    "access_token": "string",
    "refresh_token": "string",
    "expires_in": 0,
    "token_type": "Bearer"
}

Modified at 2026-06-23 04:24:01

Logout and invalidate refresh token

Refresh access token