Auth
Request a magic login link
If the account has authenticator-app (TOTP) login enabled, this responds `200 { requiresTotp: true }` and sends no email at all — call POST /auth/totp/login-verify instead. Pass `totpFallback: true` to force the normal email flow anyway.
Verify a magic link token and receive an account JWT
Verify a magic link token and receive an account JWT
Log in with an authenticator-app code, skipping the email step
Takes a live 6-digit code or an unused backup code and issues the same account JWT GET /auth/verify does — only usable once TOTP has been enabled via POST /auth/totp/confirm.
Whether authenticator-app login is enabled for this account
Whether authenticator-app login is enabled for this account
Start authenticator-app setup
Generates a new secret and returns it plus an otpauth:// URI to render as a QR code client-side. Does not enable TOTP by itself — call POST /auth/totp/confirm with a real code from the scanned app to finish. Calling this again before confirming replaces the pending secret.
Confirm authenticator-app setup, enabling TOTP login
On success, returns 8 one-time backup codes — shown exactly once, same convention as an instance API key or personal access token.
Disable authenticator-app login
Requires a valid current code (live or backup) — a merely-open session can't silently turn this off without proving the second factor still works.