Skip to main content
POST
CLI MFA step-up completion — exchange mfa_token + TOTP for tokens

Body

application/json
mfa_token
string
required

The opaque sealed handle returned by POST /auth/login in the mfa_required branch.

code
string
required

The current TOTP code for the user's ready factor.

factor_id
string

Optional factor selector. Only totp is supported programmatically; email_otp is rejected 400.

Response

Step-up succeeded — bearer tokens returned.

access_token
string
required
refresh_token
string
required
expires_in
integer
user
object

Supabase user shape. Fields beyond id and email are passthrough.