Complete login by verifying an MFA TOTP code

POST 
/api/v1/auth/mfa/verify

Requires the restricted safebucket_mfa_token (audience auth:mfa:login) issued by /auth/login. On success issues full access/refresh cookies (or, in the password-reset flow, a fresh restricted MFA-reset cookie).

Request

Responses

200

MFA verified; authenticated

Response Headers

Set-Cookie

Either full auth cookies (safebucket_access_token + safebucket_refresh_token) if no MFA step-up is needed, or a single restricted safebucket_mfa_token cookie if mfa_required: true is returned in the body.

400

MFA not enabled for this account (MFA_NOT_ENABLED)

401

Invalid or replayed TOTP code (INVALID_MFA_CODE)

404

Resource not found (NOT_FOUND)

429

Too many failed MFA attempts (MFA_RATE_LIMITED)