MfaStepUpResponseDto

JSON

{
  "step_up_token": "string",
  "expires_at": "2026-04-20T12:00:00.000Z"
}

2 properties 2 required

step_up_token string Required

Opaque sealed token (AES-256-GCM, base64url). Pass back on the next mutation via the `X-Mfa-Step-Up-Token` header. Valid for 5 minutes.

expires_at string Required

After this timestamp the token is rejected and the caller must POST /mfa/step-up again.

format: date-time

Was this page helpful?

Tell us how we can improve this guide.