Skip to main content
POST
Log In with 2FA

Authorizations

Authorization
string
header
required

API key must be provided in the Authorization header

Body

application/json
tfa_method_id
integer

ID of a specific configured 2FA method to verify against, when the user has multiple methods of the same type

Example:

3

code
string

The 2FA verification code received by the user

Example:

"123456"

secret
string

The tfa_secret token issued during the prior auth step (required for UI flow and SMS CLI flow)

Example:

"abc123secret"

tfa_method
enum<string>

The 2FA method being verified

Available options:
sms,
totp,
email
Example:

"totp"

backup_code
string

One-time-use backup code (e.g. ABCD-EFGH-IJKL) that bypasses normal 2FA verification

Example:

"ABCD-EFGH-1234"

admin
boolean

Request an admin-privileged session; only effective for admin users

Example:

false

Response

Returns formatted user object; includes session_key if called from CLI, backup_codes_remaining if a backup code was used, and legacy_tfa_user flag if applicable.

session_key
string

Unhashed 2FA session API key (returned only for CLI / Bearer-token callers)

backup_codes_remaining
integer

Number of remaining backup codes if a backup code was used

legacy_tfa_user
boolean

Present and true if the user is on the legacy 2FA system