---
title: "Generate MFA recovery codes"
method: POST
path: "/v1/auth/mfa/recovery-codes/generate"
tags: ["MFA"]
---

# Generate MFA recovery codes

`POST /v1/auth/mfa/recovery-codes/generate`

Generates 10 one-time recovery codes for the authenticated user. Any previously issued codes are invalidated. Plaintext codes are returned exactly once; the server stores only bcrypt hashes.

## Response `200`

Recovery codes generated

- MfaRecoveryCodesResponse
  - `codes` string[]

## Other responses

- `401` — Unauthenticated
- `500` — Internal server error

---

[API](https://skmtc.net/timesheet/apis/timesheet-api.md) · [All operations](https://skmtc.net/timesheet/apis/timesheet-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/timesheet/timesheet-api/revisions/5bc49bf02dad/schema)