---
title: "Complete an MFA challenge"
method: POST
path: "/agent/v1/auth/mfa/verify"
tags: ["Agent Sandbox"]
---

# Complete an MFA challenge

`POST /agent/v1/auth/mfa/verify`

Second step for '+mfa@' accounts. Submit the challenge_token from the login response with the fixed test code '424242'. Any other 6-digit code returns 401 invalid_mfa_code with attempts_remaining. Deterministic: the same challenge_token always yields the same session token.

## Request body

- object
  - `challenge_token` string, required — From the login response (starts with agt_mfa)
  - `code` string, required — Fixed test code. Anything else is rejected.

## Response `200`

Session issued: { data: { session: { token, refresh_token, expires_at, expires_in, token_type, mfa_verified } } }

## Other responses

- `401` — Wrong code ({ error: 'invalid_mfa_code', attempts_remaining: 2 }) or unknown challenge_token
- `422` — challenge_token and code are required

---

[API](https://skmtc.net/reqres/apis/reqres-api.md) · [All operations](https://skmtc.net/reqres/apis/reqres-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/reqres/reqres-api/revisions/e5ced6578853/schema)