`POST /auth/mfa/activate`

Confirm enrollment by providing the first valid TOTP code. Requires a dashboard session.

Request

{
  "code": "123456",
  "name": "Work phone"
}

Field	Type	Notes
`code`	string	The app's current 6-digit code.
`name`	string	Optional. Labels the app in `GET /auth/mfa/authenticators` so a user can tell two apart. Defaults to `Authenticator app`; trimmed to 64 characters.

Response 200: a fresh TokenPair carrying mfa_passed=true. Submitting a valid code already proves possession of the TOTP secret, so the response gives you a session you can use immediately. Swap these tokens in for the pre-activation pair. Future logins still require an MFA challenge.

{
  "access_token": "<jwt>",
  "refresh_token": "<opaque>",
  "access_expires_at": "2026-06-04T15:59:17Z",
  "refresh_expires_at": "2026-07-04T15:44:17Z"
}

Example

curl -X POST "$SEISMIC_ORCHESTRATION_URL/v0/auth/mfa/activate" \
  -H "Authorization: Bearer $SEISMIC_DASHBOARD_TOKEN" \
  -H "content-type: application/json" \
  -d '{
    "code": "123456",
    "name": "Work phone"
  }'