Check an MFA Code
Check a code against your user's MFA while already signed in — a step-up confirmation before a sensitive action. It answers yes or no and nothing else: no token is issued and the session is unchanged. This is not the sign-in step; to finish an MFA sign-in use /auth/mfa.
The token can be a current authenticator code or one of your backup codes. A backup code that matches is used up — it won't work again (see how many are left). An authenticator code is accepted once per 30-second step.
Interactive session only. This call requires an interactive dashboard session (a session JWT): sign in with /auth/login (followed by /auth/mfa when MFA is on) and send the token as Authorization: Bearer <session_jwt>. API keys and OAuth/MCP tokens get 403 with code: "interactive_session_required".
Rate limit
At most 5 code checks per hour per user, counted over a sliding hour. Every check counts, including the ones that succeed, and the limit is shared with sign-in (/auth/mfa), /mfa/activate, /mfa/disable and /mfa/backup-codes/regenerate.
Request body
XXXX-XXXX-XXXX).Response (200 OK)
true — the code is valid.Errors
Error bodies are {"success": false, "message": "…", "error": "…"} (error carries the same text as message), except where noted.
Token is required, Invalid request body, or MFA not enabled for this account.Invalid token or backup code — or missing / invalid auth.{"error": "…", "code": "interactive_session_required"}.Content-Type: application/json header is missing.Too many MFA attempts. Try again in N minutes.