Remove your authenticator
Turn the factor off, on proof. A code is required because a hijacked session that can silently remove the second factor has already removed it. A recovery code is accepted here too — someone whose phone is gone still needs a way out, and that is what recovery codes are for.
Turn the factor off, on proof.
A code is required because a hijacked session that can silently remove the second factor has already removed it. A recovery code is accepted here too — someone whose phone is gone still needs a way out, and that is what recovery codes are for.
Authorization
OAuth2PasswordBearer In: header
Cookie Parameters
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
curl -X DELETE "https://example.com/api/b/v1/mfa" \ -H "Content-Type: application/json" \ -d '{ "code": "123456" }'{ "removed": true}Your authenticator status GET
Whether this member has an authenticator, and how much rope is left. `enrolled` without `active` means a setup was started and never confirmed — the screen should offer to finish it rather than to start again, because starting again issues a new secret and invalidates the QR code already on screen. `recovery_codes_remaining` is here because running out and *then* losing the phone is the one state nobody can recover from unaided, and a member cannot be warned about a number they are never shown.
Start setting up an authenticator POST
Generate a secret. This does **not** switch the factor on. Nothing is protected until `/mfa/activate` has seen a code derived from this secret. That order is deliberate: a QR code can be mis-scanned or scanned into nothing, and switching on a factor the member's app cannot actually produce locks them out of their own account.