Two-factor authentication

Two-factor authentication adds a second factor (TOTP code from an authenticator app, or a WebAuthn passkey) on top of password login. The endpoints here cover enrollment, listing devices, removing devices, and downloading recovery codes.

For dashboard users, 2FA is browser-driven from the account settings page; the API surface here is for automation (provisioning a new admin user, programmatically rotating recovery codes, enforcing org-wide 2FA before a compliance audit). API-key callers don't need 2FA — keys are themselves a "something you have" factor; 2FA gates the human dashboard login path.

Strong recommendation: enable 2FA on every human account with role grants on production projects. Most account compromises trace to password reuse + no second factor.

What's next

Users — the resource 2FA attaches to.
Authentication — how API keys work (the non-2FA path).
Security model — the wider context.

No endpoints to show

The OpenAPI spec doesn't currently expose any endpoints under thetwo-factor-authtag. This is usually a manifest typo; check that the tag matches what the backend serves at /openapi/external.json.

Edit this page on GitHub