Skip to main content
POST
Complete MFA step-up or enrollment

Authorizations

mnemom_session
string
cookie
required

HttpOnly, Secure, SameSite=Lax cookie issued by /v1/auth/sign-in (or the SSO / email-callback flows). The value is an AES-256-GCM-encrypted blob of {access_token, refresh_token, issued_at, auth_method}. Browser clients include this automatically with credentials: "include".

Body

application/json
factor_id
string
required
challenge_id
string
required
code
string
required

6-digit TOTP code.

Response

Full session issued. Response sets mnemom_session cookie.

user
object
required

Supabase user shape. Fields beyond id and email are passthrough.