Confirm the code and switch it on
Prove the app works, then turn the factor on. Returns recovery codes. They are shown once and stored hashed, so a member who does not keep them and then loses their phone needs support to intervene — which is why the response is the only place they appear and why the screen showing them has to say so.
Prove the app works, then turn the factor on.
Returns recovery codes. They are shown once and stored hashed, so a member who does not keep them and then loses their phone needs support to intervene — which is why the response is the only place they appear and why the screen showing them has to say so.
Authorization
OAuth2PasswordBearer In: header
Cookie Parameters
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
curl -X POST "https://example.com/api/b/v1/mfa/activate" \ -H "Content-Type: application/json" \ -d '{ "code": "123456" }'{ "recovery_codes": [ "string" ]}Start setting up an authenticator POST
Generate a secret. This does **not** switch the factor on. Nothing is protected until `/mfa/activate` has seen a code derived from this secret. That order is deliberate: a QR code can be mis-scanned or scanned into nothing, and switching on a factor the member's app cannot actually produce locks them out of their own account.
Payout amounts that require a code GET
What each currency's step-up threshold is, and whether you set it. Every supported currency is listed, including the ones falling back to the platform default, because a settings screen has to show what *is* happening rather than only what has been overridden.