Error
Hosted auth
Finish a sign-in with the second factor
The second half of any sign-in that stopped at the first factor. Accepts a TOTP code or a single-use recovery code.
The challenge is single use, bound to its environment, and is not a session — it carries its own uk_c2_… prefix so it can never be spent as one. A wrong code does not consume it; the rate limit is what bounds guessing.
The session that lands carries the verification the first factor already earned: a magic link and a social callback both prove the identity before the code is asked for.
Rate limited to 20 requests per 5 minutes per IP.
POST
Error
Body
application/json