# Remove the Authenticator App

> Coming soon, upon request — this feature is turned on for your tenant by the Aurea team. [Contact us](https://www.aureahub.com/contact)

Your second factor and its recovery codes go; the next sign-in asks only the password.

## Overview

- `code`: a current code of the app. `204`, no body.
- Refused where a second factor is required (`409` `MFA_REMOVAL_REFUSED`, before the code is read): to change phones, enrol the new one instead ([Replace or Remove the App](https://docs.aureahub.com/docs/guide-two-factor.md)).
- `400` `MFA_CODE_INVALID`; `409` `MFA_NOT_ENROLLED`, `MFA_OFF`; `403` `MFA_NOT_AVAILABLE`. 20 requests per minute per client IP.

## Endpoint

### `DELETE /v1/auth/mfa/totp`

Authentication: bearer token required.

Removes the authenticator app, with a current code.

**Request body**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `code` | string | yes | Six digits from the authenticator app |

**Responses**

`204` Removed

`409` Required

```json
{
  "statusCode": 409,
  "error": "ConflictError",
  "message": "A second factor is required for this account: enrol a new one instead of removing it",
  "details": { "code": "MFA_REMOVAL_REFUSED" }
}
```

---

Web version: https://docs.aureahub.com/#mfa-totp-remove