PropperDocs

Confirm an authenticator

.md

The first code from the new authenticator, which turns two-factor on.

Scopesme:write
POST/v1/me/two-factor/confirm

The second half. When the code is right the account has two-factor from now on, and the answer carries the recovery codes. Show them; they can be read again with the recovery codes, but most people keep them when they are first put in front of them.

Request

curl -X POST https://api.proppertrading.com/v1/me/two-factor/confirm \
  -H "Authorization: Bearer ptat_9f2c1a44_3b8e7d2f5c9a1b4e6d8f0a2c4e6b8d1f" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 8e0a2c4d-6f8b-4d1e-a3c5-7e9b1d3f5a7c" \
  -d '{"code": "492817"}'

Response

{
    "data": {
        "object": "recovery_codes",
        "codes": [
            "Jy9hX6BD6l-lYhIP6Ntnz",
            "8LXgjpnR6t-prfYWRTUew",
            "RoG7CwJrOh-87xXtpj7J4",
            "JzhugBEBDE-u01QrIF8i0",
            "LYVFPDTuO9-FKLEPPim4M",
            "2EaKE8LlYB-ulwtc6u5gU",
            "EwVkoPyHrP-TEqmVABcQp",
            "9c0OGu65f3-sLKc579im1"
        ]
    },
    "meta": { "request_id": "req_01kz4bkr1aj1gv63d8fv3133ey" }
}

Errors

StatusCodeMeaning
400invalid_two_factor_codeWrong code. Try the next one; the secret stays
400two_factor_not_startedNo secret to confirm. Ask for one first
400two_factor_already_enabledThe account already has an authenticator
403insufficient_scopeThis device does not hold me:write
429rate_limit_exceededShares the limit of the two-factor step of signing in

A wrong code here is a 400, not the 401 the sign-in step answers: the token is fine, and a client that signs out on any 401 would be right to.