API reference/Auth

Replace the recovery codes

POST /v1/auth/mfa/recovery-codes

Send a code from the authenticator app or a passkey's response (start one with POST /v1/auth/passkeys/verification). Returns 10 new codes, shown once; the old codes stop working.

Authorization

bearer

Authorizationheader · stringrequired

Session token from POST /v1/auth/login with "transport": "bearer". Browsers use the session cookie that login sets instead.

Body

application/json

codestring

A code from the authenticator app

maxLength: 16

passkeyobject

A passkey's response, instead of code

2 fields

ceremony_tokenstringrequired

From POST /v1/auth/login/mfa/passkey when signing in, or POST /v1/auth/passkeys/verification when signed in

maxLength: 256

credentialobjectrequired

The PublicKeyCredential from navigator.credentials.get(), as JSON

Responses

errors: application/problem+json

200

401

Unauthorized

409

Conflict

422

Unprocessable Entity

429

Too Many Requests

500

Internal Server Error

503

Service Unavailable

Match errors on the problem's code, which stays the same, not on its message.

curl -X POST "$API_URL/v1/auth/mfa/recovery-codes" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{ "code": "123456", "passkey": { "ceremony_token": "string", "credential": {} } }'

body := strings.NewReader(`{ "code": "123456", "passkey": { "ceremony_token": "string", "credential": {} } }`) req, err := http.NewRequestWithContext(ctx, http.MethodPost, apiURL + "/v1/auth/mfa/recovery-codes", body) if err != nil { return err } req.Header.Set("Authorization", "Bearer "+token) req.Header.Set("Content-Type", "application/json") res, err := http.DefaultClient.Do(req) if err != nil { return err } defer res.Body.Close()

const res = await fetch(`${apiUrl}/v1/auth/mfa/recovery-codes`, { method: "POST", headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", }, body: JSON.stringify({ "code": "123456", "passkey": { "ceremony_token": "string", "credential": {} } }), }); const data = await res.json();

{ "code": "string", "status": 422, "title": "Unprocessable Entity", "detail": "string", "errors": [ { "message": "expected length >= 1", "location": "body.name" } ], "request_id": "req_9f86d081884c7d65", "type": "string" }