Skip to main content
POST
cURL

Body

application/json
code
string
required

A TOTP code or a single-use recovery code.

Response

Second factor accepted

csrfToken
string
required
expiresAt
string<date-time>
required
account
object
required
challengeRequired
boolean

When true, the session authorizes nothing until the second factor passes.