Complete a login with a TOTP code or a recovery code.
POST
/auth/mfa/verify
const url = 'https://api.siteqwality.com/auth/mfa/verify';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"pending_token":"example","code":"example","recovery_code":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.siteqwality.com/auth/mfa/verify \ --header 'Content-Type: application/json' \ --data '{ "pending_token": "example", "code": "example", "recovery_code": "example" }'Request Body required
Section titled “Request Body required ” Media type application/json
POST /auth/mfa/verify: exactly one of code and recovery_code.
object
pending_token
required
string
code
string | null
recovery_code
string | null
Example generated
{ "pending_token": "example", "code": "example", "recovery_code": "example"}Responses
Section titled “ Responses ”Authenticated (with redirect_path when the login kept one)
Media type application/json
One of:
A session from a login, plus where the frontend should land.
object
session_token
required
string
session_jwt
required
string
member
required
Full member info returned on every authentication response.
object
name
string | null
email
required
string
organization_id
required
string
roles
required
Array<string>
is_new_account
True only when this authentication created a new account.
boolean
redirect_path
Sanitized at start; absent on the doors that never take one.
string | null
Answer of any login endpoint when the member has confirmed TOTP. The
frontend checks mfa_required before reading an AuthResponse.
object
mfa_required
required
Always true; the discriminator against AuthResponse.
boolean
pending_token
required
sqm1_..., valid 10 minutes for 5 attempts.
string
methods
required
Array<string>
redirect_path
string | null
Example
{ "methods": [ "totp" ]}mfa_invalid_code (with attempts_remaining) or mfa_ticket_invalid
rate_limited
Internal server error
auth_unavailable