Log In with 2FA
Verifies a 2FA code (SMS, TOTP, email, or backup code) and creates a 24-hour 2FA session key on success.
Authorizations
API key must be provided in the Authorization header
Body
ID of a specific configured 2FA method to verify against, when the user has multiple methods of the same type
3
The 2FA verification code received by the user
"123456"
The tfa_secret token issued during the prior auth step (required for UI flow and SMS CLI flow)
"abc123secret"
The 2FA method being verified
sms, totp, email "totp"
One-time-use backup code (e.g. ABCD-EFGH-IJKL) that bypasses normal 2FA verification
"ABCD-EFGH-1234"
Request an admin-privileged session; only effective for admin users
false
Response
Returns formatted user object; includes session_key if called from CLI, backup_codes_remaining if a backup code was used, and legacy_tfa_user flag if applicable.