Error
Authentication
Complete a two-factor sign-in
Exchanges the challenge token plus a TOTP or recovery code for a real session. A wrong code does not consume the challenge — the rate limit is what bounds guessing. A recovery code is single-use and mails the account’s owner.
Rate limited to 20 requests per 5 minutes per IP.
POST
Error
Body
application/json