Overview
Multi-factor authentication with passkeys and authenticator apps,
including passwordless passkey sign-in. Login-flow endpoints under
/v1/auth/mfa/* and /v1/auth/passkey/* are unauthenticated: the
former are gated by a short-lived pending login token, the latter by
the WebAuthn ceremony itself. Management endpoints under /v1/mfa/*
are session-only: API keys and named access keys are rejected with a
plain 403. Enrolling a factor
(/passkeys/register/*, /totp/setup, /totp/verify) and starting the
passkey step-up challenge (/stepup/challenge) additionally require a
dashboard login session (credential_origin of dashboard_session). A
valid CLI session (cli_browser or cli_device) or a session that
predates credential attribution is refused with 403 and code
dashboard_session_required.
Listing, renaming and removing factors stay open to any login session
(removal is step-up gated once MFA is on, and a TOTP proof needs no
challenge). An account whose only factor is a passkey therefore needs a
dashboard session to start the step-up that DELETE /passkeys/{id},
DELETE /totp and POST /recovery-codes require.