Confirm TOTP enrolment

POST/api/auth/totp/confirm

totpConfirm

Session-authenticated caller only. Verifies the first 6-digit code from the authenticator, flips `totp_enabled=true`, AND returns the initial set of 10 recovery codes (plans/auth-flows.md slice #3). The codes are surfaced **exactly once** — the SPA must show them on the post-enrollment screen and the user must save them before continuing. Subsequent enrolment confirms of the same account would overwrite them, but the canonical regeneration path is `POST /api/auth/totp/recovery-codes/regenerate`.

Requires authentication using a session cookie — see tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/auth/totp/confirm' \
  -b 'ns_session=$NEOSOURCE_SESSION' \
  -H 'Content-Type: application/json' \
  -d '{"code":"string"}'

fetch

fetch("https://neosource.dev/api/auth/totp/confirm", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({"code":"string"}),
});

Request bodyrequired

application/json

TotpConfirmRequest

object

coderequired: string

additional propertiesnot allowed

Responses

200Confirmed; recovery codes returned once

application/json

TotpConfirmResponse

object

Response body for `POST /api/auth/totp/confirm`. The recovery codes are returned to the SPA **exactly once** — the user must save them before the post-enrollment screen closes (plans/auth-flows.md slice #3). Codes are display-formatted `xxxxx-xxxxx`.

recovery_codesrequired: array
10 raw recovery codes in display form. Treat as single-use equivalents of the TOTP code at the login challenge endpoint.
items
string

403Forbidden — one of: forbidden, needs_scope

application/json

one of

ErrorForbidden
NeedsScopeError
object
`403` body returned when listing private repos but the linked identity lacks the required provider scope. The SPA turns this into an incremental-authorization prompt (Tier 2) that calls the `/elevate` OAuth endpoint with this `scope`.
errorrequired
string
Always `needs_scope` — this body exists to carry the extra fields that kind needs.
"needs_scope"
scoperequired
string
The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
401Authentication required
404Not Found — one of: not_found
409Conflict — one of: already_exists, conflict
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget