Skip to main content

​
Create 2FA Setup

GET /user/2FA/create

Generates a new 2FA secret and QR code URL for the user to scan with an authenticator app (e.g. Google Authenticator).
GET /user/2FA/create
Authentication: connected Response 
{
  "status": "success",
  "data": {
    "qrCode": "https://chart.googleapis.com/chart?chs=200x200&cht=qr&chl=otpauth://...",
    "base32": "JBSWY3DPEHPK3PXP",
    "key": "randomstring"
  }
}
FieldTypeDescription
qrCodestringURL of the QR code image to scan with an authenticator app
base32stringBase32-encoded secret key (for manual entry)
keystringRandom key component used for secret generation
Save the key and base32 values — they are needed to validate and activate 2FA in the next step.

​
Validate & Activate 2FA

POST /user/2FA/validate

Validates a TOTP code against the generated secret and activates 2FA on the account. Requires a backup email address.
POST /user/2FA/validate
Authentication: connected Body Parameters
​
secret
string
required
The key value returned from the create 2FA endpoint.
​
code
string
required
The 6-digit TOTP code from the authenticator app.
​
email
string
required
Backup email address for 2FA recovery.
Response 
{
  "status": "success",
  "data": "2FA activated"
}
Errors
StatusMessage
errorInvalid email
errorInvalid code
errorMissing post parameters

​
Request 2FA Reset

POST /user/reset2FA/ask

Sends a 2FA reset code to the user’s backup email address. This is the first step of the 2FA reset process.
POST /user/reset2FA/ask
Authentication: connected Response 
{
  "status": "success",
  "data": "Reset code sent to email"
}
Errors
StatusMessage
error2FA is not activated
errorNo 2FA email found for this user
errorFailed to send email
The reset code is sent to the backup email that was provided during 2FA activation.

​
Validate 2FA Reset

POST /user/reset2FA/validate

Validates the 2FA reset code received by email and removes 2FA from the account.
POST /user/reset2FA/validate
Authentication: connected Body Parameters
​
code
string
required
The 6-digit reset code sent to the backup email. Can also be an array of individual digits.
Response 
{
  "status": "success",
  "data": "2FA has been removed"
}
Errors
StatusMessage
error2FA is not activated
errorInvalid reset code
errorFailed to remove 2FA
errorMissing code parameter