POST
/
api
/
v1
/
admin
/
auth
/
mfa-verify
Verify MFA (step 2 of 2)
curl --request POST \
  --url https://api.example.com/api/v1/admin/auth/mfa-verify
import requests

url = "https://api.example.com/api/v1/admin/auth/mfa-verify"

response = requests.post(url)

print(response.text)
const options = {method: 'POST'};

fetch('https://api.example.com/api/v1/admin/auth/mfa-verify', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v1/admin/auth/mfa-verify",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
package main

import (
"fmt"
"net/http"
"io"
)

func main() {

url := "https://api.example.com/api/v1/admin/auth/mfa-verify"

req, _ := http.NewRequest("POST", url, nil)

res, _ := http.DefaultClient.Do(req)

defer res.Body.Close()
body, _ := io.ReadAll(res.Body)

fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.post("https://api.example.com/api/v1/admin/auth/mfa-verify")
.asString();
require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/v1/admin/auth/mfa-verify")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)

response = http.request(request)
puts response.read_body

Overview

Second and final step of admin login. Present the mfaTicket returned by POST /admin/auth/login together with the current 6-digit TOTP code from the operator’s authenticator app. On success the server issues:
  • an access token — RS256 JWT, scope: 'admin', 15-minute TTL. Required as Bearer on every other admin endpoint.
  • a refresh token — opaque, 7-day TTL, stored hashed in the admin_refresh_tokens collection.
See Admin auth and MFA for why admins get a separate token scope and refresh collection.
No authentication header. The mfaTicket is the credential. Same 10/min/IP burst limiter as /admin/auth/login.

Authentication

None. The mfaTicket authenticates the request.

Path parameters

None.

Query parameters

None.

Request body

FieldTypeRequiredNotesExample
mfaTicketstringyesThe ticket from step 1. 1..4096 chars. Expires 5 minutes after issue.eyJhbGciOiJI…
totpstringyesExactly 6 digits (/^\d{6}$/). The current code from the authenticator app (30-second window).492013
deviceFingerprintstringnoOpaque client fingerprint, max 512 chars. Stored on the refresh-token row for later session attribution.fp_9a3c…

Example payload

{
  "mfaTicket": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…",
  "totp": "492013"
}

Response — 200 OK

FieldTypeNotesExample
accessTokenstringRS256 JWT, scope: 'admin', 15-minute TTL. Send as Authorization: Bearer <accessToken>.eyJhbGciOiJSUzI1NiI…
refreshTokenstringOpaque 7-day refresh token. Store securely; rotate via /admin/auth/refresh.rt_a1b2c3…
{
  "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9…",
  "refreshToken": "rt_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0"
}

Error responses

StatusCodeMeaning
400VALIDATION_FAILEDmfaTicket missing, totp not exactly 6 digits.
401INVALID_MFA_TICKETTicket malformed, expired (> 5 min), or the admin was deleted / un-enrolled between login and verify. Re-do step 1.
401MFA_INVALID_CODETOTP code did not validate against the admin’s secret (wrong code or clock skew).

Example error — 401 MFA_INVALID_CODE

{
  "type": "https://api.swappr.co.uk/errors/mfa-invalid-code",
  "title": "MFA code invalid",
  "status": 401,
  "code": "MFA_INVALID_CODE",
  "detail": "MFA code invalid",
  "instance": "/api/v1/admin/auth/mfa-verify",
  "requestId": "01HZQ7K3M4N5P6Q7R8S9T0V1W2"
}

See also

curl

curl -X POST https://api.swappr.co.uk/api/v1/admin/auth/mfa-verify \
  -H "Content-Type: application/json" \
  -d '{
    "mfaTicket": "'"$MFA_TICKET"'",
    "totp": "492013"
  }'

Postman

See docs/postman/swappr.postman_collection.jsonAdmin Auth → MFA verify.