---
title: "Verify Authenticator App Challenge"
method: POST
path: "/verify/totp"
tags: ["Authenticator App"]
---

# Verify Authenticator App Challenge

`POST /verify/totp`

Verify a challenge when enrolling a authenticator app authenticator or when re-authenticating with an existing authenticator app authenticator

## Request body

- object
  - `verificationCode` string, required — The TOTP code inputted by the user.

## Response `200`

OK

- object
  - `isVerified` boolean, required — True if the inputted TOTP is correct.
  - `accessToken` string — A new short-term token with scopes to manage authenticators (e.g. add secondary authenticators, remove authenticators, view or regenerate recovery codes). Only present if the challenge succeeded.
  - `failureReason` 'CODE_INVALID_OR_EXPIRED' | 'MAX_ATTEMPTS_EXCEEDED'

## Other responses

- `400` — Invalid Request
- `401` — Unauthorized
- `404` — Not Found

---

[API](https://skmtc.net/authsignal/apis/call-connect-api.md) · [All operations](https://skmtc.net/authsignal/apis/call-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/authsignal/call-connect-api/versions/5604d744e3ad/schema)