---
title: "Recover account via MFA recovery code"
method: POST
path: "/v1/auth/mfa/recovery"
tags: ["MFA"]
---

# Recover account via MFA recovery code

`POST /v1/auth/mfa/recovery`

Validates a recovery code. The code is a high-entropy secret that identifies its owner on its own, so no email is required. On success, marks the code used and returns a Firebase custom token. Clients should call signInWithCustomToken and immediately force re-enrollment of TOTP.

## Request body

- MfaRecoveryRequest
  - `code` string

## Response `200`

Recovery successful

- MfaRecoveryResponse
  - `customToken` string

## Other responses

- `401` — Invalid recovery code
- `500` — Internal server error

---

[API](https://skmtc.net/timesheet/apis/timesheet-api.md) · [All operations](https://skmtc.net/timesheet/apis/timesheet-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/timesheet/timesheet-api/revisions/5bc49bf02dad/schema)