Skip to main content
POST
Complete a two-step (MFA) login
Second step of login for MFA-enabled users. Exchanges the short-lived, single-use mfa_token returned by /auth/login — together with a current TOTP code or an unused backup code — for a session (sets the httpOnly recurso_session cookie). The mfa_token, and any backup code used, are consumed. Errors are deliberately generic.

Body Parameters

Example Request

Example Response

Authorizations

Authorization
string
header
required

Body

application/json
mfa_token
string
required

The single-use challenge token from /auth/login.

code
string
required

A current TOTP code or an unused backup code.

Response

Authenticated. Sets recurso_session cookie.

user
object

A dashboard user account within a tenant.

tenant
object