Activate MFA
Finish turning on two-factor authentication: send a current six-digit code from the authenticator you set up with /mfa/enroll. When the code matches, MFA is on for your user — from the next sign-in, /auth/login answers mfa_required: true and the code goes to /auth/mfa. Sessions that are already signed in stay signed in.
Interactive session only. This call requires an interactive dashboard session (a session JWT): sign in with /auth/login (followed by /auth/mfa when MFA is on) and send the token as Authorization: Bearer <session_jwt>. API keys and OAuth/MCP tokens get 403 with code: "interactive_session_required".
Only an authenticator code is accepted here, not a backup code. A code is accepted once: a code that was already used within its 30-second step is refused, so wait for the next one if you need to retry. A one-step clock difference either way is tolerated.
The change is recorded as a security event in your activity log.
Rate limit
Every activation attempt counts toward the shared limit of 5 code checks per hour per user, the successful one included (with sign-in, /mfa/verify, /mfa/disable and /mfa/backup-codes/regenerate).
Request body
Response (200 OK)
true.MFA activated successfully.Errors
Error bodies are {"success": false, "message": "…", "error": "…"} (error carries the same text as message), except where noted.
Invalid token (wrong, expired or already-used code), MFA not enrolled (call /mfa/enroll first), or a body that isn't valid JSON (Failed to decode request: …).{"error": "…", "code": "interactive_session_required"}.Content-Type: application/json header is missing.Too many MFA attempts. Try again in N minutes.