Skip to Content
SeyloDocs
API referenceSign-in and account

Turn off the authenticator app

POST
/api/v1/auth.totpDisable

Turns 2FA off and deletes the recovery codes. Needs a current authenticator code or an unused recovery code.

Any signed-in caller. Not available to MCP clients or the assistant.

Authorization

cookieseylo_session<token>

Request Body

application/json
  1. body
code*string
Length6 <= length <= 32

Response Body

Success.

application/json
  1. response
Example Request
curl -X POST 'https://example.com/api/v1/auth.totpDisable' \  -H 'Content-Type: application/json' \  -d '{  "code": "string"}'
Example Response
{}

Turn on the authenticator app POST

Checks a code from the newly enrolled authenticator, turns 2FA on and returns 10 recovery codes. They are shown once; store them somewhere safe. Any signed-in caller. Not available to MCP clients or the assistant.

Start setting up an authenticator app POST

Creates a new TOTP secret for the signed-in person and returns it as a QR-ready otpauth URL. It is not enforced until auth.totpConfirm. CONFLICT when 2FA is already on. Needs a sign-in or auth.reauth from the last 15 minutes (FORBIDDEN details.reason "reauth" otherwise). Any signed-in caller. Not available to MCP clients or the assistant.