Complete login with a two-factor recovery code.
Two-factor
Complete login with a two-factor recovery code.
A fallback for users who cannot produce their primary code but still
have a recovery code on file (see recovery_codes_available on the
login response). Post the challenge token together with one recovery
code:
{ "challenge_token": "eyJ...", "recovery_code": "abcd-efgh-ijkl" }
On success the response is 200 with the final access token, in the
same shape as POST /api/v1/tokens. Each recovery code is single-use.
An incorrect code returns 400 (invalid_grant); an expired
challenge returns 410 (challenge_expired). Rate limited to 10
requests per minute (429).
Used by the embed login widget; the hosted Razor flow has its own equivalent action on the AuthenticationController.
POST
Complete login with a two-factor recovery code.