Skip to main content
POST
Authorize New 2FA Method

Authorizations

Authorization
string
header
required

API key must be provided in the Authorization header

Body

application/json
tfa_method
enum<string>

Existing method type to use for authorization; automatically 'email' when the account has no active methods

Available options:
sms,
totp,
email
Example:

"email"

tfa_method_id
integer

ID of an existing method to verify with; required for sms/totp when the user has multiple methods of the same type

Example:

3

backup_code
string

Backup code that skips the send/verify round-trip and grants authorization directly

Example:

"ABCD-EFGH-1234"

Response

Returns {success: true, secret} (secret needed for PUT verify step), or {success: true, msg: "Authorization successful."} when a backup code is used.

success
boolean

Always true

secret
string

TFA secret required for the PUT verification step (present when using a send/verify flow)

msg
string

"Authorization successful." (present when backup_code is used and authorization is granted immediately)