Skip to main content
POST
Confirm email enrollment and complete a forced-2FA login.

Query Parameters

data
unknown
required

Response

Enrollment confirmed; the access token and recovery codes are returned.

Returned from the mid-login enrollment confirm endpoints (POST /api/v1/tokens/two-factor/enroll/{email|totp}/confirm) once the user has proven control of the new mechanism. Completes a forced-enrollment login: it both finalizes the JWT access token and surfaces the freshly generated recovery codes. The property names are snake_case to match the wire format of the other token endpoints (see TokenPayload).

confirmed
boolean

Always true on a success response; the enrollment is now active.

recovery_codes
string[] | null

The user's recovery codes, generated as part of first-time enrollment. These are shown once and never returned again — prompt the user to store them somewhere safe. Each code is single-use at POST /api/v1/tokens/two-factor/recovery.

access_token
string | null

The JWT access token. Use it as Authorization: bearer {access_token} for subsequent API calls — login is complete.

token_type
string | null

Always Bearer.

expires_in
integer<int32>

Seconds until the access token expires.