Complete sign-in with a multi-factor code

POST 
/signin2fa

Finishes a sign-in that requires multi-factor authentication. Send the token from the first sign-in step as a Bearer token and the code as a JSON string; the response is the session token. This route is outside the /api/v1 path.

Permission required: A first-step sign-in token (password accepted, multi-factor code pending).

Caution: The response contains a session token that grants access as the user; store it securely.

Request

Responses

200

The body is the session token as a JSON string. If the sign-in session cannot be found (for example, browser cookies are blocked), the status is still 200 but the body is a JSON object with an error message instead of a token.

401

The code is not valid or was used recently, two-factor is not enabled for the user, or the multi-factor provider rejected it. The body is a message.