All six methods here require an active session (call after login()/register()), except verifyBackupCode(), which is a real recovery login path — see its own description below.
Generated directly from @threshold1/auth@0.3.0 — the real, currently-installed package, not hand-typed. Regenerated on every build; if this page and the actual SDK ever disagree, the SDK is right and this page needs a rebuild, not an edit.
enrollTotp(): Promise<{
otpauthUrl: string;
qrCodeDataUrl: string;
secret: string;
}>;
Begin (or restart) TOTP enrollment for the currently authenticated user. Returns a QR code (data URL) to display for scanning in an authenticator app (Google Authenticator / Authy / 1Password), plus the raw secret for manual entry. Call verifyTotp() with the resulting 6-digit code to confirm enrollment.
Calling this again always replaces any existing TOTP secret immediately, even a previously-verified one — only call it when the user genuinely intends to (re)set up TOTP.
Requires an active session — call after login()/register().
Promise<{
otpauthUrl: string;
qrCodeDataUrl: string;
secret: string;
}>
verifyTotp(code): Promise<{
enrolled: boolean;
}>;
Verify a TOTP code for the currently authenticated user. The first
successful call after enrollTotp() completes enrollment (the
resolved enrolled flag flips to true); every later call is an
ordinary step-up check.
Requires an active session — call after login()/register().
string
The 6-digit code from the user's authenticator app.
Promise<{
enrolled: boolean;
}>
sendSmsOtp(phone): Promise<void>;
Send an SMS OTP to the given phone number for the currently authenticated user — enrolls (or re-verifies) that phone as an SMS step-up factor. Does NOT establish a new session; pair with verifySmsOtp() to confirm the code.
Requires an active session — call after login()/register().
string
E.164 format, e.g. "+14155551234".
Promise<void>
verifySmsOtp(code): Promise<{
phone: string;
}>;
Verify an SMS OTP code for the currently authenticated user. Call after sendSmsOtp() once the user enters the code in your UI.
Requires an active session — call after login()/register().
string
The 6-digit code sent by sendSmsOtp().
Promise<{
phone: string;
}>
The phone number that was just verified.
generateBackupCodes(): Promise<{
codes: string[];
}>;
Generate 10 new backup (recovery) codes for the currently authenticated user, immediately invalidating any previous batch. The raw codes are returned exactly once, in this response — display them to the user now (e.g. "download" / "copy" UI); they are never stored in recoverable form and cannot be fetched again later.
Requires an active session — call after login()/register().
Promise<{
codes: string[];
}>
verifyBackupCode(identifier, code): Promise<UserProfile>;
Verify a backup code and, on success, establish a new session — the account-recovery path for when the user's primary second factor (TOTP app, SMS-registered phone) is unavailable. Unlike enrollTotp()/verifySmsOtp()/etc. above, this does NOT require an existing session (the user may have none — that's the whole point of a recovery code) and DOES fire auth.onAfterAuth on success, same as verifyOtp()/verifyDeviceCode().
Deliberately NOT part of AUTH_CASCADE / login()'s automatic fallback loop: a backup code only exists if the user already saved one, and silently trying "is this a valid backup code?" during every ordinary login attempt would be surprising, unrequested behavior — same reasoning that keeps confirmDeviceSend()/verifyDeviceCode() (State B) as manual, explicitly-invoked methods rather than cascade entries. Call this directly from a "Use a backup code instead" UI path you build yourself.
| string
| {
email?: string;
externalUserId?: string;
}
The user's email, or { email } /
{ externalUserId }. At least one of email/externalUserId is
required to resolve which user's backup codes to check.
string
The backup code entered by the user (dashes/case are normalized server-side, so "abcde-fghjk" and "ABCDEFGHJK" both work).
Promise<UserProfile>