Skip to main content
POST
cURL

Headers

X-CSRF-Token
string
required

Echoes the token from the current session. Required on every unsafe method.

Body

application/json
code
string
required

A TOTP code or a single-use recovery code.

Response

Two-factor enabled

recoveryCodes
string[]
required

Returned exactly once. Only digests are stored.