API Reference

Verify TOTP during invite setup

POST /api/auth/verify-invite-totp

Verifies the TOTP code during invite acceptance. On success, marks the user's TOTP as verified, creates a session, and sets the browser session. The invite must first be accepted with /api/auth/accept-invite so the password is set before TOTP verification.

Operation IDverifyInviteTotp

Authentication

No authentication is required.

Request body

This request body is required.

Content typeapplication/json

requestobject

2 properties

tokenstringrequired

codestringrequired

Pattern: [0-9]{6}

Success response body

200TOTP verified, session created

TOTP verified, session created

Content typeapplication/json

responseobject

1 property

successboolean

Error responses

400Invalid token or incomplete setup

Invalid token or incomplete setup

No response content schema is documented.

401Invalid TOTP code

Invalid TOTP code

No response content schema is documented.

429Too many requests

Too many requests

Content typeapplication/json

responseobject

2 properties

errorstring

Example: NOT_FOUND

messagestring

Example: Resource not found

Example response

{
  "error": "RATE_LIMITED",
  "message": "Too many failed TOTP attempts. Try again later."
}

Code examples

curl --request POST \
  --url 'https://your-envoy.example.com/api/auth/verify-invite-totp' \
  --header 'Content-Type: application/json' \
  --data '{
  "token": "string",
  "code": "string"
}'

const response = await fetch("https://your-envoy.example.com/api/auth/verify-invite-totp", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "token": "string",
    "code": "string"
  }),
});

if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = response.status === 204 ? null : await response.json();
console.log(data);