SQRL/ Docs
POST/auth/otp-validate

Complete two-factor sign-in

Completes a sign-in that reported requires_2FA by submitting the one-time code together with the two-factor token from the sign-in attempt, and issues the access token.

AccessNo sign-in required

This is the second step of the two-factor flow. Call it only after POST /auth/login has answered with requires_2FA set to true, an empty token, and a token_2fa value. Send that token_2fa value back as TokenHash2FA, along with the same email address and the one-time code the platform sent to the account. The pairing matters: the code is only accepted against the sign-in attempt the token came from.

The response has the same shape as POST /auth/login, this time with token populated. Send it as Authorization: Bearer <access-token> on every authenticated call, and keep sid for POST /auth/refresh. The user_info object is the User shape described in Shared objects.

note:
Field names are capitalised on this call

Unlike the rest of the /auth endpoints, this request uses Email, OTPCode, and TokenHash2FA. Lower-case names are a different payload, so copy the capitalisation exactly.

Body parameters
Emailstringrequired
The address used for the sign-in attempt this code completes.
OTPCodestringrequired
The one-time code sent to the account, as a string.
TokenHash2FAstringrequired
The token_2fa value returned by the sign-in attempt that reported requires_2FA.
Was this page helpful?