# Confirm the Authenticator App

> Coming soon, upon request — this feature is turned on for your tenant by the Aurea team. [Contact us](https://www.aureahub.com/contact)

The enrolment's first code: the app becomes your second factor, and your ten recovery codes are shown — once.

## Overview

- `code`: six digits the app shows now. `200` with `enrolled` `true` and `recoveryCodes`: store them before anything else — they are never shown again. `Cache-Control: no-store`.
- An app enrolled before is replaced, and its recovery codes with it.
- `400` `MFA_CODE_INVALID` for a wrong code; `409` `MFA_NO_PENDING` when no enrolment waits (or it is older than 15 minutes); `409` `MFA_OFF`; `403` `MFA_NOT_AVAILABLE`. 20 requests per minute per client IP.

## Endpoint

### `POST /v1/auth/mfa/totp/confirm`

Authentication: bearer token required.

Confirms the enrolment with its first code.

**Request body**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `code` | string | yes | Six digits from the authenticator app |

**Responses**

`200` Enrolled

```json
{
  "enrolled": true,
  "recoveryCodes": [
    "K7M2P-9QXR4", "B3NWT-6HJ8D", "Y5CFL-2ZQ9M", "R8VKD-4PXN7", "H2JTS-7MCW5",
    "P9QLB-3XKF6", "N4WZR-8DJT2", "C6MHV-5LQP9", "T3XNF-9BKR4", "W7DPJ-2VMZ8"
  ]
}
```

`400` Wrong code

```json
{
  "statusCode": 400,
  "error": "BadRequestError",
  "message": "The code is not correct",
  "details": { "code": "MFA_CODE_INVALID" }
}
```

`409` None waiting

```json
{
  "statusCode": 409,
  "error": "ConflictError",
  "message": "No enrolment is waiting: start one again",
  "details": { "code": "MFA_NO_PENDING" }
}
```

**Example request**

```bash
curl -X POST https://api.aureahub.com/v1/auth/mfa/totp/confirm \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "code": "492039" }'
```

---

Web version: https://docs.aureahub.com/#mfa-totp-confirm