Disable TOTP

Session-only. Turn off two-factor authentication. Requires both the account password and a live code; an unlocked session alone is not sufficient.

POST /me/totp/disable

Disable TOTP

cURL

curl --request POST \
  --url https://aropay.aro.media/api/v1/me/totp/disable \
  --header 'Content-Type: application/json' \
  --cookie aropay_session= \
  --data '
{
  "password": "<string>",
  "code": "<string>"
}
'

200

{
  "ok": "<unknown>",
  "data": {
    "totpEnabled": "<unknown>"
  }
}

Authorizations

aropay_session · string · cookie · required

Browser session cookie minted by POST /auth/login (or passkey login). httpOnly, SameSite=Lax, 24 h TTL. Endpoints marked Session-only accept only this credential and return 403 session_required for API keys.

Body

application/json

password · string · required

code · string · required

Pattern: ^[0-9]{6}$

Response

200

application/json

Two-factor authentication disabled.

ok · any · required

data · object · required

Show child attributes