Confirm TOTP enrollment by submitting a valid code

POST

/account/security/2fa/confirm

• Local development behind nginx (port 8088 by default)

On first valid code: flips confirmed_at, mints + returns N single-use recovery codes (plaintext, shown ONCE). After this call the login flow refuses password-only.

Authorizations

• cookieAuth

Request Body ^required

object

code

required

6-digit TOTP code from the authenticator app.

string

Responses

200

Enrollment confirmed; recovery codes shown ONCE.

object

recovery_codes

required

Single-use backup codes — shown ONCE. Plaintext; never reachable again from any API. The server only persists sha256(normalize(code)).

Array<string>

400

No pending enrollment or wrong code.

object

error

required

Human-readable error summary

string

Example

the request could not be completed

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}