Skip to main content
Request OTP

Authorizations

Authorization
string
header
required

HTTP Basic Auth. For OTP request: pass email as username only (password field is ignored). For token exchange: pass email as username and the OTP code (received by email) in the password field (email:otp_code).

Response

OTP sent successfully, or MFA challenge initiated.

When MFA is not enabled for the user, returns {message: "ok"}. When MFA is enabled, returns {mfa_required: true, challenge_token: "..."} — use challenge_token to proceed via POST /api/v1/users/mfa/challenge/{kid}.

message
string

Returned when MFA is not required

Example:

"ok"

mfa_required
boolean

Present and true when MFA is enabled — use challenge_token to proceed

challenge_token
string

Short-lived token for MFA challenge flow (present when mfa_required is true)

Last modified on July 23, 2026