Mint a fresh batch of recovery codes

POST

/account/security/2fa/recovery/regenerate

• Local development behind nginx (port 8088 by default)

Invalidates the prior batch (even unused codes) + returns N new plaintext codes shown ONCE. Requires the caller’s current password.

Authorizations

• cookieAuth

Request Body ^required

Body for the disable + regenerate-recovery surfaces. Re-asks for the current password so a stolen-session attacker can’t kill 2FA + lock the owner out in one move.

object

current_password

required

string format: password

Responses

200

New recovery codes shown ONCE.

object

recovery_codes

required

Array<string>

400

Malformed request

object

error

required

Human-readable error summary

string

Example

the request could not be completed

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}