Turns the second step on, by showing a code from the app just set up.
POST
Answers with the recovery codes, the only time they are shown.
Errors
401 when the code is wrong, 403 when a bearer token was used, 404 when
nothing is being set up, 409 when two-step sign-in is already on, 429
when too many codes have been wrong.
sessioncookie
tessera_session<token>Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.
application/json- body
Body of POST /account/mfa/totp/confirm.
code*stringA code the app shows for the secret just set up.
On; the recovery codes, shown once
application/json- response
New recovery codes. Shown once: only their digests are kept.
recovery_codes*array<string>Each works once, in place of a code from the app.
curl -X POST 'https://example.com/api/v1/account/mfa/totp/confirm' \ -H 'Content-Type: application/json' \ -d '{ "code": "string"}'{ "recovery_codes": [ "string" ]}