MFA Setup
Set up and verify multi-factor authentication.
MFA Setup
Set up and verify multi-factor authentication (MFA) for a user account. All MFA setup endpoints require a valid JWT — the user must be logged in to enrol.
Initiate MFA Setup
POST /v1/auths/mfa/setup
Initiate MFA setup. Returns a QR code (as a data URI or otpauth:// URL) for scanning with an authenticator app, along with one-time backup codes. Store backup codes securely — they cannot be retrieved again.
https://cloud.vanitypass.com with X-Environment: Sandbox. No real bookings or charges. Production access: contact us./v1/auths/mfa/setupSandbox credentials
Keys never leave your browser — they are sent only to cloud.vanitypass.com with X-Environment: Sandbox.
curl -X POST 'https://cloud.vanitypass.com/v1/auths/mfa/setup' \ -H 'Content-Type: application/json' \ -H 'X-Environment: Sandbox' \
Verify MFA Setup
POST /v1/auths/mfa/setup/verify
Confirm MFA setup with a test OTP generated by the authenticator app. This finalises enrolment. Until this step is completed, MFA is not active on the account.
| Field | Type | Required | Description |
|---|---|---|---|
otp | string | yes | 6-digit TOTP from the authenticator app. |
https://cloud.vanitypass.com with X-Environment: Sandbox. No real bookings or charges. Production access: contact us./v1/auths/mfa/setup/verifySandbox credentials
Keys never leave your browser — they are sent only to cloud.vanitypass.com with X-Environment: Sandbox.
curl -X POST 'https://cloud.vanitypass.com/v1/auths/mfa/setup/verify' \
-H 'Content-Type: application/json' \
-H 'X-Environment: Sandbox' \
-d '{"otp":"123456"}'Verify MFA OTP
POST /v1/auths/mfa/verify
Verify MFA OTP during login. Called after the login initiate step returns mfa_required: true. On success, the session is fully authenticated and tokens are issued.
| Field | Type | Required | Description |
|---|---|---|---|
otp | string | yes | 6-digit TOTP from the authenticator app, or a backup code. |
session_token | string | yes | Short-lived session token returned by the login initiate step. |
https://cloud.vanitypass.com with X-Environment: Sandbox. No real bookings or charges. Production access: contact us./v1/auths/mfa/verifySandbox credentials
Keys never leave your browser — they are sent only to cloud.vanitypass.com with X-Environment: Sandbox.
curl -X POST 'https://cloud.vanitypass.com/v1/auths/mfa/verify' \
-H 'Content-Type: application/json' \
-H 'X-Environment: Sandbox' \
-d '{"otp":"123456","session_token":"st_example"}'