---
title: "Validate MFA challenge"
method: POST
path: "/v3/mfa/challenge/validate"
tags: ["mfa"]
---

# Validate MFA challenge

`POST /v3/mfa/challenge/validate`

Validate the MFA challenge for creating an MFA-trusted API sign in session. This validation requires the `challengeId` and `token` from `POST /v3/mfa/challenge`.

After the validation is complete, your API session is MFA trusted.

There are two stages in the BILL MFA process.
1. **MFA setup**: Add a valid phone number for setting up MFA in the organization (with `POST /v3/mfa/setup`), and then complete the setup by validating the entered phone number (with `POST /v3/mfa/validate`). At this point, the phone number is registered for the MFA sign in operation.
2. **MFA sign in**: Generate an MFA challenge (with `POST /v3/mfa/challenge`), and then complete MFA sign in by validating the MFA challenge (with `POST /v3/mfa/challenge/validate`). At this point, your API session is MFA trusted.

**Note**: In the production environment, BILL requires an MFA-trusted API session for a set of API operations.
* Enable vendor `autoPay`
* Enable recurring bill `autoPayment`
* Create a payment or bulk payment
* Create a bank account for a BILL organization
* Reset MFA (Complete MFA setup and MFA sign-in again)

## Headers

- `sessionId` string, nullable — API session ID generated with `/v3/login`
- `devKey` string, nullable — Developer key generated with your BILL developer account

## Request body

- MfaChallengeValidateRequestDto — Validate MFA challenge
  - `challengeId` string, required — MFA `challengeId` from the `POST /v3/mfa/challenge` response
  - `token` string, required — Validation `token` sent to the registered phone number
  - `device` string — Mobile device name. This is a nickname for your mobile device. Set this field when `rememberMe` is set as `true`.
  - `machineName` string — Machine name. This is a nickname for the machine used to complete MFA sign in. Set this field when `rememberMe` is set as `true`.
  - `rememberMe` boolean — Set as `true` for the generated MFA ID to expire in 30 days

## Response `200`

Validate MFA challenge response

- MfaChallengeValidateResponseDto — Response for MFA challenge validation.
  - `rememberMeId` string — MFA ID. This value expires in 30 days. When your API session is expiring, this value is required for generating a new MFA-trusted API session with `POST /v3/login`.

## Other responses

- `4XX` — List of errors.
- `5XX` — List of errors.

---

[API](https://skmtc.net/bill/apis/bill-v3-api.md) · [All operations](https://skmtc.net/bill/apis/bill-v3-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/bill/bill-v3-api/revisions/0483350c434e/schema)