---
title: "Check 2FA verification code (checkTwoFaVerificationCode)"
method: POST
path: "/api/auth/2fa/verification/check"
tags: ["two-factor-auth-controller"]
---

# Check 2FA verification code (checkTwoFaVerificationCode)

`POST /api/auth/2fa/verification/check`

Checks 2FA verification code, and if it is correct the method returns a regular access and refresh token pair.

The API method is rate limited (using rate limit config from TwoFactorAuthSettings), and also will block a user after X unsuccessful verification attempts if such behavior is configured (in TwoFactorAuthSettings).

Will return a Bad Request error if provider is not configured for usage, and Too Many Requests error if rate limits are exceeded.

## Query parameters

- `providerType` 'TOTP' | 'SMS' | 'EMAIL' | 'BACKUP_CODE', required
- `verificationCode` string, required

## Response `200`

OK

- JwtPair — JWT Pair
  - `token` string — The JWT Access Token. Used to perform API calls.
  - `refreshToken` string — The JWT Refresh Token. Used to get new JWT Access Token if old one has expired.
  - `scope` 'SYS_ADMIN' | 'TENANT_ADMIN' | 'CUSTOMER_USER' | 'REFRESH_TOKEN' | 'PRE_VERIFICATION_TOKEN' | 'MFA_CONFIGURATION_TOKEN'

---

[API](https://skmtc.net/thingsboard/apis/thingsboard-rest-api.md) · [All operations](https://skmtc.net/thingsboard/apis/thingsboard-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/thingsboard/thingsboard-rest-api/revisions/40169ccdec5c/schema)