Answer a two-factor challenge

The second half of a sign-in. Send the challenge from the first step with one of three answers: a code from an authenticator app, one of the account's recovery codes, or a passkey assertion. Which of them the account can use is in methods on the challenge.

Everything else about the sign-in, including who is signing in, which app and which scopes, comes from the challenge. This request cannot change any of it.

Request

curl https://api.proppertrading.com/v1/auth/token/two-factor \
  -H "Content-Type: application/json" \
  -d '{
    "challenge": "a14ea608e89261062f4e90792701ef2a7c5ad1188c8537108efd788d1390ce03",
    "code": "123456"
  }'

A recovery code is spent when it is used, exactly as on the web. Nine remain after the first one.

Send one of the three, not several. The passkey object is the assertion with id, rawId, type and a response holding clientDataJSON, authenticatorData, signature and optionally userHandle. Ask for its options first: the assertion has to answer a challenge this API issued.

Response

Identical to a successful sign-in, with session.two_factor set to true.

{
    "data": {
        "object": "access_token",
        "status": "signed_in",
        "token": "ptat_9f2c1a44_3b8e7d2f5c9a1b4e6d8f0a2c4e6b8d1f",
        "session": { "id": "9f2c1a44", "object": "session", "two_factor": true },
        "workspace": { "object": "workspace", "id": "acmefunded", "name": "Acme Funded", "platform": false, "url": "https://acmefunded.com", "branding": null, "maintenance": false }
    },
    "meta": { "request_id": "req_01kz4bkr1aj1gv63d8fv3133ey" }
}

The challenge is used up either way

It survives exactly one correct code, and at most five wrong ones. After that it is gone and the sign-in starts again from the password. A client that hits expired_two_factor_challenge should return to its email and password screen rather than asking for another code.

Challenges also expire on their own after five minutes.

Errors