Post
/api/v1/twoFactorChallenges.verifyChallenge
Verifies the email or TOTP code for an OAuth two-factor authentication challenge and returns the loginToken and userId.
This endpoint does not require authentication. Requests are limited to 5 per minute per caller. The challenge is removed when the maximum number of failed attempts is reached.
Changelog
| Version | Description |
|---|---|
| 8.7.0 | Added |
Body parameters
Verify challenge
{
"challengeId": "8f4c2d1e9a7b6c5d3e2f1a0b",
"code": "482913"
}object
challengeId
string Required
The ID of the pending two-factor challenge returned by the login flow.
Example8f4c2d1e9a7b6c5d3e2f1a0b
code
string Required
The two-factor code provided by the user for the challenge.
Example482913
Responses
200
OK
Verification successful
{
"loginToken": "exampleLoginTokenString123",
"userId": "aobEdbYhXfu5hkeqG",
"success": true
}object
loginToken
string
userId
string
success
boolean
400
Bad Request
Missing parameters
{
"success": false,
"error": "challengeId and code are required",
"errorType": "error-parameter-required"
}Invalid code
{
"success": false,
"error": "Invalid code",
"errorType": "error-invalid-code"
}Challenge not found
{
"success": false,
"error": "challenge not found",
"errorType": "error-challenge-not-found"
}Challenge expired
{
"success": false,
"error": "challenge expired",
"errorType": "error-challenge-expired"
}User not found
{
"success": false,
"error": "user not found",
"errorType": "error-user-not-found"
}Max attempts reached
{
"success": false,
"error": "TOTP Maximun Failed Attempts Reached",
"errorType": "totp-max-attempts"
}object
success
boolean
error
string
errorType
string