Complete login with an authenticator code
const url = 'https://api.aetherpush.com/v1/auth/mfa/totp';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"pendingToken":"example","code":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.aetherpush.com/v1/auth/mfa/totp \ --header 'Content-Type: application/json' \ --data '{ "pendingToken": "example", "code": "example" }'Verifies a six-digit TOTP code for a pending login and, on success, consumes the pending token and issues the session access key. Each code works once; reusing a code within its time window is rejected.
Request Bodyrequired
Section titled “Request Bodyrequired”object
Six-digit code from the authenticator app.
Example generated
{ "pendingToken": "example", "code": "example"}Responses
Section titled “Responses”MFA satisfied. Use the returned access key as a Bearer token.
object
Raw bearer token. Send as Authorization: Bearer <accessKey>
on subsequent requests. Store securely (cookie or secure
storage). The server cannot reveal it again.
Unix timestamp in milliseconds at which this token expires.
Present and true when the account has no MFA method yet. Every
account is expected to enroll a passkey or an authenticator app.
The dashboard nags until mfaSetupDeadline and blocks
navigation after it. Clients that cannot enroll (the CLI) may
ignore this field.
Unix timestamp in milliseconds. Present alongside
mfaSetupRequired; fixed on the account’s first MFA-less login
and stable on later logins. Before it, MFA setup is a
dismissible prompt; after it, the dashboard requires setup
before continuing.
Example
{ "accessKey": "abc123-base64url-secret", "expires": 1719964800000}Pending token or code missing.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}The pending login is invalid or expired, the code is wrong, no authenticator is set up, or the code was already used.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}Too many MFA attempts.
Returned with HTTP 429 when an endpoint-specific rate limit is hit,
including the per-tenant management API budget. Not the process-wide
address limiter (see GlobalAddressRateLimitErrorResponse).
retryAfterSeconds
indicates how long the client should wait before retrying, and matches
the Retry-After header when that header is set. code names the
limit that fired so clients can translate without matching on error.
object
Example
{ "error": "Too many login attempts. Please try again later.", "code": "too_many_login_attempts", "retryAfterSeconds": 900, "requestId": "req_abc123"}Authenticator codes are not configured on this server.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}