REST API · signup
POST /signup/second-factor/confirm
Enrol the second factor and finish. Body: `{signup_token, code}`, the current six-digit code from the authenticator. Step 4 of 4.
Returns the backup codes once and never again, creates the account's first project, and mints an account management token. That management token is what every other route in this document takes, so store it before doing anything else. The sign-up token is spent here. A wrong code costs one attempt and the reply says how many are left; at zero the sign-up is over and the confirmation link has to be presented again.
post_api_signup_second_factor_confirm
Authentication
None
Request body
application/json · required
{
"signup_token": "28c8ecf5b743232be83a35e88c9da629f5a01c14a5d8885277431e83e163b60a",
"code": "493021"
}Responses
200
The account is complete: backup codes, the first project, and the management token that reaches the rest of this API.
application/json
{
"backup_codes": [
"ATFRQ-HH4D5",
"MY7A3-E3AMK",
"8JFEM-MJYYW",
"9QFW8-KAU6Y",
"A63EL-ULHPQ",
"3JMG7-FGRXH",
"B9RN5-XXKRG",
"DY58T-ESD5U",
"DKLZW-JESUE",
"J3UUP-TENU8"
],
"project": {
"id": "41e6cb06-57ed-4214-921f-54d17423c60d",
"slug": "signup-project-8dbb5b2a",
"name": "Signup project 8dbb5b2a",
"apiBaseUrl": "signup-project-8dbb5b2a.echorelay.cloud"
},
"api_token": "er_mcp_d2e0e90963857c1d12e98767308d48af79218e32d284d666"
}400
No `signup_token` was sent.
application/json
{
"required": [
"error"
],
"properties": {
"error": {
"description": "Machine-readable error code, e.g. \"not_found\", \"forbidden\", \"validation\".",
"type": "string",
"enum": [
"bad_request",
"unauthorized",
"insufficient_credits",
"forbidden",
"web_only",
"allowlist_widens",
"not_found",
"conflict",
"draft_revision_conflict",
"rollback_confirmation_conflict",
"not_replayable",
"targets_outside_allowlist",
"gone",
"deprecated_operation",
"validation",
"rate_limited",
"payment_provider",
"verification_unavailable",
"analytics_unavailable",
"credential_vault_unavailable",
"notification_grants_unavailable"
]
},
"message": {
"description": "Human-readable explanation of what went wrong. Absent on a field-level validation failure, where `fields` carries the detail instead.",
"type": "string"
},
"object": {
"description": "The resource the error concerns, when there is one.",
"required": [
"type",
"id"
],
"properties": {
"type": {
"type": "string"
},
"id": {
"type": "string"
}
},
"type": "object"
},
"action": {
"description": "What to do next, naming the call or the panel page that does it. Absent when there is no corrective step.",
"type": "string"
},
"fields": {
"description": "Present when `error` is \"validation\" — one message per rejected field, keyed by the field name.",
"type": "object",
"additionalProperties": {
"type": "string"
}
},
"retry_after": {
"description": "An RFC 3339 timestamp, the moment the request may be retried. Not every `rate_limited` refusal carries one.",
"type": "string",
"format": "date-time"
}
},
"type": "object"
}401
The signup token is unknown, expired or already spent.
application/json
{
"required": [
"error"
],
"properties": {
"error": {
"description": "Machine-readable error code, e.g. \"not_found\", \"forbidden\", \"validation\".",
"type": "string",
"enum": [
"bad_request",
"unauthorized",
"insufficient_credits",
"forbidden",
"web_only",
"allowlist_widens",
"not_found",
"conflict",
"draft_revision_conflict",
"rollback_confirmation_conflict",
"not_replayable",
"targets_outside_allowlist",
"gone",
"deprecated_operation",
"validation",
"rate_limited",
"payment_provider",
"verification_unavailable",
"analytics_unavailable",
"credential_vault_unavailable",
"notification_grants_unavailable"
]
},
"message": {
"description": "Human-readable explanation of what went wrong. Absent on a field-level validation failure, where `fields` carries the detail instead.",
"type": "string"
},
"object": {
"description": "The resource the error concerns, when there is one.",
"required": [
"type",
"id"
],
"properties": {
"type": {
"type": "string"
},
"id": {
"type": "string"
}
},
"type": "object"
},
"action": {
"description": "What to do next, naming the call or the panel page that does it. Absent when there is no corrective step.",
"type": "string"
},
"fields": {
"description": "Present when `error` is \"validation\" — one message per rejected field, keyed by the field name.",
"type": "object",
"additionalProperties": {
"type": "string"
}
},
"retry_after": {
"description": "An RFC 3339 timestamp, the moment the request may be retried. Not every `rate_limited` refusal carries one.",
"type": "string",
"format": "date-time"
}
},
"type": "object"
}422
The code is wrong (`attempts_left` says how many remain), or the first project could not be created.
application/json
{
"required": [
"error"
],
"properties": {
"error": {
"description": "Machine-readable error code, e.g. \"not_found\", \"forbidden\", \"validation\".",
"type": "string",
"enum": [
"bad_request",
"unauthorized",
"insufficient_credits",
"forbidden",
"web_only",
"allowlist_widens",
"not_found",
"conflict",
"draft_revision_conflict",
"rollback_confirmation_conflict",
"not_replayable",
"targets_outside_allowlist",
"gone",
"deprecated_operation",
"validation",
"rate_limited",
"payment_provider",
"verification_unavailable",
"analytics_unavailable",
"credential_vault_unavailable",
"notification_grants_unavailable"
]
},
"message": {
"description": "Human-readable explanation of what went wrong. Absent on a field-level validation failure, where `fields` carries the detail instead.",
"type": "string"
},
"object": {
"description": "The resource the error concerns, when there is one.",
"required": [
"type",
"id"
],
"properties": {
"type": {
"type": "string"
},
"id": {
"type": "string"
}
},
"type": "object"
},
"action": {
"description": "What to do next, naming the call or the panel page that does it. Absent when there is no corrective step.",
"type": "string"
},
"fields": {
"description": "Present when `error` is \"validation\" — one message per rejected field, keyed by the field name.",
"type": "object",
"additionalProperties": {
"type": "string"
}
},
"retry_after": {
"description": "An RFC 3339 timestamp, the moment the request may be retried. Not every `rate_limited` refusal carries one.",
"type": "string",
"format": "date-time"
}
},
"type": "object"
}