Turn on Multi-Factor Authentication for Signing In
This endpoint activates Multi-Factor Authentication for a user's account sign-in flow. Once enabled, the user must complete a second verification step — via SMS short code, a time-based one-time password (TOTP) app, or a legacy TOTP method — on every subsequent login. Activating MFA significantly reduces the risk of unauthorized account access.
Endpoint
POST /settings/MfaSignIn
Authentication
Bearer token required. Obtain via:
POST https://api.banking.netevia.dev/api/auth/v2Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.
When to use
Call this endpoint when a user opts into MFA from their account security settings. It should be triggered after the user selects their preferred second-factor method and, where applicable, has provided and verified their phone number or email address. This is a one-time activation call; subsequent logins will automatically require the MFA step once enabled.
Query Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
| type | string (enum) | No | The MFA method to enable. Accepted values: ShortMessageCode (SMS one-time code), TimeBasedCode (TOTP authenticator app), LegacyTimeBasedCode (legacy TOTP). Defaults to the account's configured method if omitted. |
Response
200 OK
MFA has been successfully enabled for the user's account. The response confirms the activation.
{
"success": true,
"message": "Multi-Factor Authentication has been enabled for sign-in."
}Error Codes
| Code | When it happens |
|---|---|
| 400 | Invalid type value supplied, or required supporting data (e.g., phone number for ShortMessageCode) is missing or invalid |
| 401 | Bearer token is missing, expired, or invalid |
| 403 | Insufficient permissions to modify account security settings |
| 404 | User account not found |
| 500 | Internal server error while enabling MFA |
Common Mistakes
- Passing an unrecognized string for
type— onlyShortMessageCode,TimeBasedCode, andLegacyTimeBasedCodeare valid values; any other value returns 400. - Calling this endpoint without first ensuring a verified phone number is on file when using
ShortMessageCode; the platform requires a validated destination before MFA can be activated via SMS. - Using an expired Bearer token — tokens last only 10 minutes; refresh via
POST /api/auth/refreshbefore making this call. - Calling this endpoint multiple times unnecessarily; if MFA is already enabled, verify the current state with
GET /settings/MfaSignIn(or equivalent status endpoint) before re-activating.
Related Endpoints
POST /api/auth/v2— Obtain a Bearer token to authenticate API requestsPOST /api/auth/refresh— Refresh an expiring Bearer tokenPOST /settings/MfaTransaction— Enable MFA for individual transactions (separate from sign-in MFA)
Example
curl -X POST "https://api.banking.netevia.dev/settings/MfaSignIn?type=ShortMessageCode" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json"Success