Skip to content
SupaCloud Docs
Select themeSelect language

POST /api/auth/2fa/verify — exchange the interim 2FA token + a valid TOTP (or single-use recovery) code for a full session (ADR 0031 D10). Re-fetches the login row and re-checks the lockout so the second factor honours the same lockout chokepoint as the password step.

POST
/api/auth/2fa/verify
curl --request POST \
  --url https://example.com/api/auth/2fa/verify \
  --header 'Content-Type: application/json' \
  --data '{ "code": "example" }'

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
code
required
string
Examplegenerated
{
  "code": "example"
}

Responses

Section titled “Responses”

200

Section titled “200”

Full session issued after a valid TOTP or recovery code

Media typeapplication/json
object
csrf_token
required
string
expires_in
required
integer format: int64
user
required
object
email
string | null
id
required
string format: uuid
Examplegenerated
{
  "csrf_token": "example",
  "expires_in": 1,
  "user": {
    "email": "example",
    "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
  }
}

400

Section titled “400”

Structured client error

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

401

Section titled “401”

Invalid interim session or second factor

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

500

Section titled “500”

Structured server error

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}