> ## Documentation Index
> Fetch the complete documentation index at: https://orchestrator-docs.hexoforge.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Complete login with TOTP

> Finish authentication after Login returns requires_totp.

Call after [Login](/api-reference/gate/login) returns `requires_totp: true` and a `login_ticket`. Requires `X-API-Key`.

## Request body

<ParamField body="login_ticket" type="string" required>
  From the `/login` response. Max 128 characters. Expires in **5 minutes**.
</ParamField>

<ParamField body="totp_code" type="string" required>
  Six-digit TOTP code.
</ParamField>

## Response

**200 OK**

```json theme={null}
{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "refresh_token": "dGhpcyBpcyBhIHJlZnJlc2g...",
  "token_type": "bearer",
  "expires_in": 900,
  "last_login_method": "email"
}
```

TOTP codes cannot be replayed within **60 seconds**.

## Status codes

| Code | Meaning                                                          |
| ---- | ---------------------------------------------------------------- |
| 200  | Login successful                                                 |
| 401  | Invalid or expired ticket, or invalid TOTP                       |
| 403  | Account disabled, email not verified, IP block, or firewall deny |
| 429  | Rate limited                                                     |