---
title: "Verify TOTP code"
method: POST
path: "/auth/2fa/verify"
tags: ["Auth"]
---

# Verify TOTP code

`POST /auth/2fa/verify`

Verify a TOTP code. Used for both setup confirmation (`setup: true`) and login
verification. When `setup: true`, returns backup codes. During login, returns the
full login response.

## Request body

- TwoFactorVerifyRequest
  - `user_id` integer, required
  - `client_id` integer, required
  - `code` string, required — 6-digit TOTP code.
  - `setup` boolean — Set to `true` during initial 2FA setup confirmation.

## Response `200`

Verification successful.

- union
  - TwoFactorSetupConfirmResponse
    - `success` boolean
    - `backup_codes` string[] — One-time backup codes; store securely.
  - LoginResponse
    - `token` string — JWT access token (15-minute lifetime).
    - `refresh_token` string — Refresh token (7-day lifetime).
    - `refresh_expires_at` string, date-time
    - `client_id` integer
    - `clients` ClientSummary[]
      - `client_id` integer
      - `clientname` string
      - `status` 'active' | 'inactive'
    - `is_parent` boolean
    - `user` UserProfile
      - `id` integer
      - `username` string
      - `email` string, email
      - `full_name` string
      - `role` 'admin' | 'viewer'
      - `client_id` integer
      - `two_factor_enabled` boolean

---

[API](https://skmtc.net/netcorecloud/apis/email-api-v6.md) · [All operations](https://skmtc.net/netcorecloud/apis/email-api-v6/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/netcorecloud/email-api-v6/versions/73f83bc2eff8/schema)