---
title: "Verify MFA recovery code REST API | HitKeep"
description: "Reference for the HitKeep REST API operation Verify MFA recovery code, including request parameters, responses, and authentication notes."
canonical: "https://hitkeep.com/api/operations/apiauthmfarecovery-codeverify/"
---

# Verify MFA recovery code REST API

POST

/api/auth/mfa/recovery-code/verify

FetchcURL

```
const url = 'http://127.0.0.1:25737/api/auth/mfa/recovery-code/verify';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: '{"challenge_token":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0","code":"example"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```
curl --request POST \
  --url http://127.0.0.1:25737/api/auth/mfa/recovery-code/verify \
  --header 'Content-Type: application/json' \
  --data '{ "challenge_token": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "code": "example" }'
```

-

Consumes a recovery code for a pending MFA challenge.

## Request Bodyrequired

application/json

object

**challenge_token**

required

string format: uuid

**code**

required

string

##### Examplegenerated

```
{
  "challenge_token": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "code": "example"
}
```

## Responses

### 200

Status

application/json

object

**message**

string

**status**

string

##### Examplegenerated

```
{
  "message": "example",
  "status": "example"
}
```

[Previous Verify MFA email sign-in link](https://hitkeep.com/api/operations/apiauthmfaemail-linkverify/)[Next Verify MFA TOTP](https://hitkeep.com/api/operations/apiauthmfatotpverify/)