Confirm 2FA setup

POST

/login/2fa/setup/confirm

curl --request POST \
  --url https://auth.timetonic.com/login/2fa/setup/confirm \
  --header 'Content-Type: application/json' \
  --data '{ "setup_token": "example", "code": "example" }'

Confirm enforced TOTP setup before login completes.

Request Body^required

Media typeapplication/json

object

setup_token

required

string

code

required

string

/^\d{6}$/

Example^generated

{
  "setup_token": "example",
  "code": "example"
}

Responses

200

2FA setup confirmed and login completed

Media typeapplication/json

object

success

boolean

jwt

JWT access token

string

refresh_token

Refresh token

string

user

object

id

string format: uuid

email

string format: email

redirect

Redirect URL with token appended

string format: uri

form_post

HTML form body returned when OIDC response_mode is form_post

string

passThroughParameters

Parameters stored from initial bootstrap

object

key

additional properties

string

mustChangePassword

Whether user must change password

boolean

passwordResetToken

Token for password change (if mustChangePassword is true)

string

authenticationPolicies

Password policies for change form

object

twoFactorSetupRequired

Whether 2FA setup is enforced by policy

boolean

twoFactorData

2FA setup data if setup is required

object

secret

string

qr_uri

string

Example

{
  "success": true
}

400

Setup token expired, OIDC request expired, or invalid verification code

Media typeapplication/json

object

success

boolean

error

string

message

string

Example

{
  "success": false
}

404

Setup token points to a user that no longer exists

Media typeapplication/json

object

success

boolean

error

string

message

string

Example

{
  "success": false
}

422

Validation error

Media typeapplication/json

object

success

boolean

error

string

message

string

errors

object

key

additional properties

Array<string>

Example

{
  "success": false,
  "error": "validation_error",
  "message": "The given data was invalid",
  "errors": {
    "email": [
      "The email field is required."
    ]
  }
}