Verify MFA passcode

POST

/oauth/mfaVerify

Last modified:2026-09-26 01:44:36

OperationId:MFAVerify

Checks a 6-digit passcode from an authenticator app against a TOTP secret. No authentication is required, and nothing is saved. Use it during enrollment to confirm the user scanned the QR code correctly before you call an enroll endpoint. The response is always 200: branch on valid, and read message for the reason. Codes from 1 time step before or after the current one are accepted, which is 60 seconds of clock drift either way. The only supported pair is mfa_vendor google with mfa_type authenticator.

Request

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

Verification result. Always returned, including for missing parameters and wrong codes. Check valid.

Bodyapplication/json

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://awqacore01.crexendocloud.com/ns-api/v2/oauth/mfaVerify' \
--header 'Content-Type: application/json' \
--data '{
    "mfa_key": "JBSWY3DPEHPK3PXP",
    "mfa_passcode": "123456",
    "mfa_vendor": "google",
    "mfa_type": "authenticator"
}'

Response Example

Success

{
    "status": "success",
    "message": "MFA passcode verified successfully",
    "valid": true,
    "apiversion": "46.0.0"
}

Modified at 2026-09-26 01:44:36

Generate MFA authenticator secret

Enroll in MFA with username and password