Authorize by Multi-Factor Authentication

The POST /api/auth/v2/2Fac endpoint completes Multi-Factor Authentication (MFA) by validating a one-time code delivered to the user's registered device alongside their primary credentials. Upon successful verification, it returns a Bearer token that authorizes subsequent API requests. This endpoint is the second step in an MFA-enabled authentication flow that follows the initial credential submission.

Endpoint

POST /api/auth/v2/2Fac

Authentication

This endpoint does not require a pre-existing Bearer token — it is part of the login flow. A Bearer token is issued upon successful completion of MFA.

When to use

Use this endpoint when your integration enforces Multi-Factor Authentication for partner users or administrators logging into the Netevia Banking API. After the user submits their username and password through the primary auth flow and receives a ticket referencing the pending MFA challenge, call this endpoint with that ticket and the one-time code to complete the authentication process and obtain a usable Bearer token.

Request Body

{
  "username": "[email protected]",
  "password": "S3cur3P@ssw0rd!",
  "ticket": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "code": "847291",
  "remember30day": false
}

Response

200 OK

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTYiLCJuYW1lIjoianNtaXRoQGV4YW1wbGUuY29tIiwiaWF0IjoxNzQ5Mzk5NjAwfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
  "expiration": "2026-06-08T14:30:00Z",
  "userId": 123456
}

Error Codes

Common Mistakes

• Submitting the code after it has expired — OTP codes are time-limited (typically 30–60 seconds for TOTP or a few minutes for SMS/email codes); request a new code if needed.
• Reusing a ticket from a previous MFA session — each ticket is single-use and tied to one authentication attempt; restart the login flow to obtain a fresh ticket.
• Omitting the ticket field — the ticket is required to correlate this MFA step with the preceding credential submission; without it the request will return a 400 error.
• Setting remember30day: true on shared or public devices — this bypasses MFA for 30 days on that device and should only be used on trusted personal devices.

Related Endpoints

• POST /api/auth/v2 — Initial authentication step; submit username, password, and partnerId to begin the login flow and receive the MFA ticket.
• POST /api/auth/refresh — Refresh an existing Bearer token before it expires (10-minute lifetime) to maintain an active session.

Example

curl -X POST https://api.banking.netevia.dev/api/auth/v2/2Fac \
  -H "Content-Type: application/json" \
  -d '{
    "username": "[email protected]",
    "password": "S3cur3P@ssw0rd!",
    "ticket": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "code": "847291",
    "remember30day": false
  }'