Skip to main content
POST
/
api
/
v1
/
gate
/
{project_id}
/
auth
/
login
/
totp
Complete login with TOTP
curl --request POST \
  --url https://org-api.hexoforge.dev/api/v1/gate/{project_id}/auth/login/totp \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "login_ticket": "<string>",
  "totp_code": "<string>"
}
'

Documentation Index

Fetch the complete documentation index at: https://orchestrator-docs.hexoforge.dev/llms.txt

Use this file to discover all available pages before exploring further.

Call after Login returns requires_totp: true and a login_ticket. Requires X-API-Key.

​
Request body

​
login_ticket
string
required
From the /login response. Max 128 characters. Expires in 5 minutes.
​
totp_code
string
required
Six-digit TOTP code.

​
Response

200 OK 
{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "refresh_token": "dGhpcyBpcyBhIHJlZnJlc2g...",
  "token_type": "bearer",
  "expires_in": 900,
  "last_login_method": "email"
}
TOTP codes cannot be replayed within 60 seconds.

​
Status codes

CodeMeaning
200Login successful
401Invalid or expired ticket, or invalid TOTP
403Account disabled, email not verified, IP block, or firewall deny
429Rate limited