Confirms a code from the authenticator app and turns two-factor authentication on.
HTTP
POST /account/mfa/enableAccess: Session token only. API keys get 403 with insufficient_scope.
Request body #
JSON.
| Field | Type | Required | Description |
|---|---|---|---|
code | string | yes | The 6-digit code the app shows for the secret from Start two-factor setup. |
JSON
{ "code": "123456" }Response 201 #
JSON
{ "recoveryCodes": ["3fa9c-1b2d4", "9c0e1-77aa3"] }recoveryCodes holds 10 codes. Each works once instead of an app code when you sign in. They are shown only now.
Errors #
| Status | error | When |
|---|---|---|
| 401 | unauthenticated | The token is missing or not valid. |
| 409 | mfa_not_started | You did not start the setup. |
| 409 | mfa_enabled | Two-factor authentication is on already. |
| 422 | invalid_request | code is invalid. |
| 429 | rate_limited | Too many requests, see Rate limiting. |
See Errors for the error format.