> ## Documentation Index
> Fetch the complete documentation index at: https://api-documentation.kare-app.fr/llms.txt
> Use this file to discover all available pages before exploring further.

# Post boauthtwo factorverify backup code

> Verify a backup code for two-factor authentication



## OpenAPI

````yaml /api/bo/openapi.json post /bo/auth/two-factor/verify-backup-code
openapi: 3.0.3
info:
  title: KARE API
  description: Backend API for the KARE platform
  version: dev
servers:
  - url: http://localhost:3000
    description: Local dev
security: []
tags:
  - name: better-auth
    description: >-
      Better Auth's own endpoints (sign-in, session, MFA, password) - generated
      from the audience's live config via `generateOpenAPISchema()`, not
      hand-written.
paths:
  /bo/auth/two-factor/verify-backup-code:
    post:
      tags:
        - better-auth
      description: Verify a backup code for two-factor authentication
      operationId: betterAuthPostTwoFactorVerifyBackupCodeBOV1
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                code:
                  type: string
                  description: 'A backup code to verify. Eg: "123456"'
                disableSession:
                  type: boolean
                  description: If true, the session cookie will not be set.
                trustDevice:
                  type: boolean
                  description: >-
                    If true, the device will be trusted for 30 days. It'll be
                    refreshed on every sign in request within this time. Eg:
                    true
              required:
                - code
      responses:
        '200':
          description: Backup code verified successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  user:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Unique identifier of the user
                      email:
                        type: string
                        format: email
                        nullable: true
                        description: User's email address
                      emailVerified:
                        type: boolean
                        nullable: true
                        description: Whether the email is verified
                      name:
                        type: string
                        nullable: true
                        description: User's name
                      image:
                        type: string
                        format: uri
                        nullable: true
                        description: User's profile image URL
                      twoFactorEnabled:
                        type: boolean
                        description: >-
                          Whether two-factor authentication is enabled for the
                          user
                      createdAt:
                        type: string
                        format: date-time
                        description: Timestamp when the user was created
                      updatedAt:
                        type: string
                        format: date-time
                        description: Timestamp when the user was last updated
                    required:
                      - id
                      - twoFactorEnabled
                      - createdAt
                      - updatedAt
                    description: The authenticated user object with two-factor details
                  session:
                    type: object
                    properties:
                      token:
                        type: string
                        description: Session token
                      userId:
                        type: string
                        description: ID of the user associated with the session
                      createdAt:
                        type: string
                        format: date-time
                        description: Timestamp when the session was created
                      expiresAt:
                        type: string
                        format: date-time
                        description: Timestamp when the session expires
                    required:
                      - token
                      - userId
                      - createdAt
                      - expiresAt
                    description: >-
                      The current session object, included unless disableSession
                      is true
                required:
                  - user
                  - session
        '400':
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: >-
            Bad Request. Usually due to missing parameters, or invalid
            parameters.
        '401':
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Unauthorized. Due to missing or invalid authentication.
        '403':
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
          description: >-
            Forbidden. You do not have permission to access this resource or to
            perform this action.
        '404':
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
          description: Not Found. The requested resource was not found.
        '429':
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
          description: >-
            Too Many Requests. You have exceeded the rate limit. Try again
            later.
        '500':
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
          description: >-
            Internal Server Error. This is a problem with the server that you
            cannot fix.
      security:
        - bearerAuth: []
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Bearer token authentication

````