---
title: "POST /api/two-factor-auth/verify/"
method: POST
path: "/api/two-factor-auth/verify/"
tags: ["Auth"]
---

# POST /api/two-factor-auth/verify/

`POST /api/two-factor-auth/verify/`

Verifies TOTP two-factor authentication

## Request body

- VerifyTOTP
  - `email` string, email — Deprecated. User identity is resolved from the 2FA token. This field is ignored and will be removed in a future version.
  - `code` string
  - `backup_code` string

## Response `200`

- union
  - object
    - `user` object — An object containing information related to the user.
      - `first_name` string — The first name of related user.
      - `username` string, email — The username of the related user. This is always an email address.
      - `language` string — An ISO 639 language code (with optional variant) selected by the user. Ex: en-GB.
    - `token` string — Deprecated. Use the `access_token` instead.
    - `access_token` string — 'access_token' can be used to authorize for other endpoints that require authorization. This token will be valid for 10 minutes.
    - `refresh_token` string — 'refresh_token' can be used to get a new valid 'access_token'. This token will be valid for 168 hours.
  - object
    - `two_factor_auth` string — The type of the two factor auth that is required to perform.
    - `token` string — The temporary token for verifying authentication using 2fa.

## Other responses

- `400`
- `401`
- `404`
- `429`

---

[API](https://skmtc.net/baserow/apis/baserow-api-spec.md) · [All operations](https://skmtc.net/baserow/apis/baserow-api-spec/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/baserow/baserow-api-spec/revisions/0c490e5b0c7f/schema)