Two-factor

POST two factor disable

Use this endpoint to disable two factor authentication.

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

password*string

User password

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/two-factor/disable" \  -H "Content-Type: application/json" \  -d '{    "password": "string"  }'

{  "status": true}

POST two factor enable

Enable two factor authentication. Pass method 'totp' (default) to set up an authenticator app (returns TOTP URI and backup codes), or 'otp' to enable email/SMS-based codes immediately.

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

password*string

User password

method?string

Value in

"otp"
"totp"

issuer?string

Custom issuer for the TOTP URI

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/two-factor/enable" \  -H "Content-Type: application/json" \  -d '{    "password": "string"  }'

{  "method": "otp",  "totpURI": "string",  "backupCodes": [    "string"  ]}

POST two factor generate backup codes

Generate new backup codes for two-factor authentication

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

password*string

The users password.

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/two-factor/generate-backup-codes" \  -H "Content-Type: application/json" \  -d '{    "password": "string"  }'

{  "status": true,  "backupCodes": [    "string"  ]}

POST two factor get totp uri

Use this endpoint to get the TOTP URI

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

password*string

User password

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/two-factor/get-totp-uri" \  -H "Content-Type: application/json" \  -d '{    "password": "string"  }'

{  "totpURI": "string"}

POST two factor send otp

Send two factor OTP to the user

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

trustDevice?boolean

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/two-factor/send-otp" \  -H "Content-Type: application/json" \  -d '{}'

{  "status": true}

POST two factor verify backup code

Verify a backup code for two-factor authentication

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

code*string

A backup code to verify. Eg: "123456"

disableSession?boolean

If true, the session cookie will not be set.

trustDevice?boolean

If true, the device will be trusted for 30 days. It'll be refreshed on every sign in request within this time. Eg: true

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/two-factor/verify-backup-code" \  -H "Content-Type: application/json" \  -d '{    "code": "string"  }'

{  "user": {    "id": "string",    "email": "user@example.com",    "emailVerified": true,    "name": "string",    "image": "http://example.com",    "twoFactorEnabled": true,    "createdAt": "2019-08-24T14:15:22Z",    "updatedAt": "2019-08-24T14:15:22Z"  },  "session": {    "token": "string",    "userId": "string",    "createdAt": "2019-08-24T14:15:22Z",    "expiresAt": "2019-08-24T14:15:22Z"  }}

POST two factor verify otp

Verify two factor OTP

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

code*string

The otp code to verify. Eg: "012345"

trustDevice?boolean

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/two-factor/verify-otp" \  -H "Content-Type: application/json" \  -d '{    "code": "string"  }'

{  "token": "string",  "user": {    "id": "string",    "email": "user@example.com",    "emailVerified": true,    "name": "string",    "image": "http://example.com",    "createdAt": "2019-08-24T14:15:22Z",    "updatedAt": "2019-08-24T14:15:22Z"  }}

POST two factor verify totp

Verify two factor TOTP

Authorization

bearerAuth

AuthorizationBearer <token>

Session token from the set-auth-token response header (bearer plugin)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

code*string

The otp code to verify. Eg: "012345"

trustDevice?boolean

If true, the device will be trusted for 30 days. It'll be refreshed on every sign in request within this time. Eg: true

Response Body

`application/json`

curl -X POST "https://example.com/api/auth/two-factor/verify-totp" \  -H "Content-Type: application/json" \  -d '{    "code": "string"  }'

{  "status": true}

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`