Disable MFA

Turn off two-factor authentication for your user. Removing a sign-in factor needs two proofs on top of your credential, both checked by the server: your current password and a current code (an authenticator code, or a backup code — which is used up). The request carries them as a JSON body.

Interactive session only. This call requires an interactive dashboard session (a session JWT): sign in with /auth/login (followed by /auth/mfa when MFA is on) and send the token as Authorization: Bearer <session_jwt>. API keys and OAuth/MCP tokens get 403 with code: "interactive_session_required".

What happens on success:

• Sign-in no longer asks for a code. The authenticator secret and the remaining backup codes stop working; to turn MFA on again, enroll anew (new secret, new codes).
• Every signed-in session of your user ends — session tokens issued before this call are revoked, in the dashboard and anywhere else. The response carries a fresh session token (access_token) so the caller can carry on. API keys are not affected.
• The change is recorded as a security event in your activity log.

Rate limits

The password check shares one counter with every other current-password check (for example changing your password, or regenerating backup codes): after five attempts without a correct password, requests are refused with 429 until 15 minutes pass with no further attempt — each attempt restarts the 15 minutes. A correct password resets the counter. The code check counts toward the shared limit of 5 code checks per hour per user (with sign-in, /mfa/activate, /mfa/verify and backup-code regeneration); it runs only after the password is accepted.

Request body

Response (200 OK)

Errors

Error bodies are {"success": false, "message": "…", "error": "…"} (error carries the same text as message), except where noted.