1. Docs
  2. API Reference
  3. OAuth hosted login: submit MFA challenge

OAuth hosted login: submit MFA challenge

POST/oauth/mfa-challenge

Submits a TOTP code or recovery code from the hosted MFA-challenge page, identified by the challenge_token issued during login. On successful verification it optionally issues a trusted-device cookie (when remember_device is set and the Environment allows it), mints an authorization code, and redirects to the client's redirect_uri; on failure it re-renders the challenge page with the error and the available factor list. Throttled to 10 requests per minute.

Request body

application/json

challenge_tokenstring Required
factorenum Required

one of "totp" · "recovery_code"

codestring Required
client_idstring Required
redirect_uristring Required
response_typestring Required
scopestring Required
statestring Optional
code_challengestring Required
code_challenge_methodstring Required
remember_deviceboolean Optional

Responses

200
Request
curl -X POST "https://auth.canopy-io.com/oauth/mfa-challenge" \
  -H "Content-Type: application/json" \
  -d '{
    "challenge_token": "string",
    "factor": "totp",
    "code": "string",
    "client_id": "string",
    "redirect_uri": "string",
    "response_type": "string",
    "scope": "string",
    "state": "string",
    "code_challenge": "string",
    "code_challenge_method": "string",
    "remember_device": false
  }'
Response
HTTP/1.1 200

(empty body)
 Related endpoints Was this page helpful?

Tell us how we can improve this guide.

Canopy