Totp Verify

POST

/auth/totp/verify

curl --request POST \
  --url https://example.com/auth/totp/verify \
  --header 'Content-Type: application/json' \
  --data '{ "code": "example", "pending_token": "example" }'

Public second step of login: pending token (proves the password already passed, ≤5 min old) + a TOTP or backup code → session. Rate-limited (see middleware) against code brute-force; every failure mode returns the same 401.

Request Body^required

Media typeapplication/json

TotpVerifyRequest

object

code

required

Code

string

>= 6 characters <= 16 characters

pending_token

required

Pending Token

string

Example^generated

{
  "code": "example",
  "pending_token": "example"
}

Responses

200

Successful Response

Media typeapplication/json

AuthTokenResponse

object

api_token

required

Api Token

string

Example^generated

{
  "api_token": "example"
}

422

Validation Error

Media typeapplication/json

HTTPValidationError

object

detail

Detail

Array<object>

ValidationError

object

loc

required

Location

Array

msg

required

Message

string

type

required

Error Type

string

Example^generated

{
  "detail": [
    {
      "loc": [
        "example"
      ],
      "msg": "example",
      "type": "example"
    }
  ]
}