Two-factor authentication

Confirm two-factor authentication setup

POST/api/2fa/setup/confirm

Verifies an authenticator code, enables two-factor authentication, and returns a new set of backup codes.

Try it

Headers

Name	Type	Description
Authorizationrequired	string	Token returned by POST /api/auth/login, or an API key (`umami_…`) created under Settings → API keys (self-hosted only). `Bearer <token>`.

Request body

Name	Type	Description
tokenrequired	string

Example request

{
  "token": "string"
}

Responses

200The operation completed successfully.

Name	Type	Description
anyOf	anyOf

200 example

{
  "error": {
    "code": "string",
    "lockedUntil": "2024-01-15T09:30:00Z",
    "message": "string"
  }
}

400Bad request.

Name	Type	Description
errorrequired	object	Error details returned when the operation fails.

400 example

{
  "error": {
    "code": "bad-request",
    "message": "Bad request.",
    "status": 400
  }
}

401Unauthorized.

Name	Type	Description
errorrequired	object	Error details returned when the operation fails.

401 example

{
  "error": {
    "code": "unauthorized",
    "message": "Unauthorized.",
    "status": 401
  }
}

404Not found.

Name	Type	Description
errorrequired	object	Error details returned when the operation fails.

404 example

{
  "error": {
    "code": "not-found",
    "message": "Not found.",
    "status": 404
  }
}

429The operation completed successfully.

Name	Type	Description
errorrequired	object	Error details returned when the operation fails.

429 example

{
  "error": {
    "code": "string",
    "lockedUntil": "2024-01-15T09:30:00Z",
    "message": "string"
  }
}

503Service unavailable.

Name	Type	Description
errorrequired	object	Error details returned when the operation fails.

503 example

{
  "error": {
    "code": "service-unavailable",
    "message": "Service unavailable.",
    "status": 503
  }
}

Code samples

cURL

curl -X POST 'https://api.example.com/api/2fa/setup/confirm' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "token": "string"
}'

PreviousComplete two-factor sign-in NextDisable two-factor authentication