Replaces the recovery codes with a new set, and answers with them.
For when they have been used up or may have been seen. Every old code stops working.
Errors
401 when the password or code is wrong, 403 when a bearer token was
used, 404 when two-step sign-in is not on, 429 when too many codes have
been wrong.
sessiontessera_session<token>Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.
application/json- body
Body of DELETE /account/mfa/totp and POST /account/mfa/recovery-codes.
Either proves it is the owner asking: the password, or a code.
code?|A code from the app, or a recovery code, instead of the password.
current_password?|The current password. Omitted by an account without one, which confirms
by a recent sign-in instead, or when code is given.
8 <= length <= 1024The new codes, shown once
application/json- response
New recovery codes. Shown once: only their digests are kept.
recovery_codes*array<string>Each works once, in place of a code from the app.
curl -X POST 'https://example.com/api/v1/account/mfa/recovery-codes' \ -H 'Content-Type: application/json' \ -d '{}'{ "recovery_codes": [ "string" ]}