Verify MFA challenge with backup code

POST 
/auth/mfa/verify-backup

Verifies a one-time backup code against an MFA challenge token issued during login. On success, completes the authentication flow and returns user data, tokens, and the count of remaining backup codes.

Request

Responses

200

Backup code verified, authentication complete

400

Validation error

401

Invalid or expired backup code

402

MAU quota exceeded (mau_quota_exceeded): the sign-in would add a new monthly active user to an account already at its MAU limit; the body includes limit and current

403

Refused at completion: session_limit_exceeded: the user is at max_concurrent_sessions and the application refuses new sessions (deny_new); the body includes max_sessions and current_sessions; or account_inactive: the user was suspended after proving their first factor