Regenerate Backup Codes
Replace your user's MFA backup codes with a fresh set of ten. Every earlier backup code stops working at once. The new codes are returned only in this response; the server keeps them hashed.
Interactive session only. This call requires an interactive dashboard session (a session JWT): sign in with /auth/login (followed by /auth/mfa when MFA is on) and send the token as Authorization: Bearer <session_jwt>. API keys and OAuth/MCP tokens get 403 with code: "interactive_session_required".
Because this hands out new sign-in factors, it needs two proofs on top of your credential: your current password and a current code (an authenticator code, or one of the old backup codes — which is used up). The change is recorded as a security event in your activity log.
Rate limits
The password check shares one counter with every other current-password check (for example changing your password, or /mfa/disable): after five attempts without a correct password, requests are refused with 429 until 15 minutes pass with no further attempt — each attempt restarts the 15 minutes. A correct password resets the counter. The code check counts toward the shared limit of 5 code checks per hour per user (with sign-in, /mfa/activate, /mfa/verify and /mfa/disable); it runs only after the password is accepted.
Request body
Response (200 OK)
true.XXXX-XXXX-XXXX.Errors
Error bodies are {"success": false, "message": "…", "error": "…"} (error carries the same text as message), except where noted.
Current password and a current authentication code are required., Invalid request body, or MFA not enabled for this account (MFA is off, or enrolled but not yet activated).Current password is incorrect. or Invalid token or backup code — or missing / invalid auth.{"error": "…", "code": "interactive_session_required"}.Content-Type: application/json header is missing.Too many failed attempts. Please try again later. (password counter) or Too many MFA attempts. Try again in N minutes. (code limit).