AuthenticationTwo-factor authentication
Verify a backup code
POST
Verify a backup code for two-factor authentication
sessioncookie
gamma.session_token<token>The session cookie a sign-in sets. Over HTTPS its name carries the __Secure- prefix. Browsers send it on their own; other clients keep it from the sign-in response.
application/json- body
code*stringA backup code to verify. Eg: "123456"
disableSession?booleanIf true, the session cookie will not be set.
trustDevice?booleanIf true, the device will be trusted for 30 days. It'll be refreshed on every sign in request within this time. Eg: true
Backup code verified successfully
application/json- response
user*The authenticated user object with two-factor details
session*The current session object, included unless disableSession is true
Example Request
curl -X POST 'http://localhost:3000/api/auth/two-factor/verify-backup-code' \ -H 'Content-Type: application/json' \ -d '{ "code": "string"}'Example Response
{ "user": { "id": "string", "email": "user@example.com", "emailVerified": true, "name": "string", "image": "http://example.com", "twoFactorEnabled": true, "createdAt": "2019-08-24T14:15:22Z", "updatedAt": "2019-08-24T14:15:22Z" }, "session": { "token": "string", "userId": "string", "createdAt": "2019-08-24T14:15:22Z", "expiresAt": "2019-08-24T14:15:22Z" }}