---
title: "Disables TOTP 2FA on the caller's account."
method: POST
path: "/api/v1/core/me/mfa/disable"
tags: ["Core/Me"]
---

# Disables TOTP 2FA on the caller's account.

`POST /api/v1/core/me/mfa/disable`

Disables 2FA after one last TOTP check. The shared secret is wiped —
re-enabling later starts from a fresh QR code and key. Recovery codes
are also invalidated.

## Request body

- MfaCodeRequest — Body for `POST /me/mfa/enable` and `/disable` — the TOTP the user just typed.
  - `code` string, nullable

## Response `204`

2FA disabled

## Other responses

- `400` — Invalid or expired TOTP
- `401` — Not authenticated

---

[API](https://skmtc.net/neotimo/apis/neotimo-api.md) · [All operations](https://skmtc.net/neotimo/apis/neotimo-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/neotimo/neotimo-api/revisions/2ecf51b1543e/schema)