Complete password sign-in after TOTP second step (Option C JWT only)

cURL

curl -sS -X POST "$FLUIDE_BASE_URL/api/v1/auth/two-factor/verify-sign-in" \
  -H "Authorization: Bearer $FLUIDE_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

const baseUrl = process.env.FLUIDE_BASE_URL;

const response = await fetch(`${baseUrl}/api/v1/auth/two-factor/verify-sign-in`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.FLUIDE_ACCESS_TOKEN}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
});

if (!response.ok) throw new Error(`HTTP ${response.status}: ${await response.text()}`);
console.log(await response.json());

import os
import requests

base_url = os.environ["FLUIDE_BASE_URL"]
headers = {
        "Authorization": f"Bearer {os.environ['FLUIDE_ACCESS_TOKEN']}",
}

response = requests.post(
    f"{base_url}/api/v1/auth/two-factor/verify-sign-in",
    headers=headers,
    json={},
    timeout=30,
)
response.raise_for_status()
print(response.json())

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

String baseUrl = System.getenv("FLUIDE_BASE_URL");
HttpClient client = HttpClient.newHttpClient();
HttpRequest.Builder builder = HttpRequest.newBuilder()
    .uri(URI.create(baseUrl + "/api/v1/auth/two-factor/verify-sign-in"))
    .header("Authorization", "Bearer " + System.getenv("FLUIDE_ACCESS_TOKEN"))
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString("{}"))
    .build();
HttpResponse<String> response = client.send(builder.build(), HttpResponse.BodyHandlers.ofString());
if (response.statusCode() >= 400) throw new RuntimeException("HTTP " + response.statusCode() + ": " + response.body());
System.out.println(response.body());

<?php
$baseUrl = getenv("FLUIDE_BASE_URL");
$ch = curl_init($baseUrl . "/api/v1/auth/two-factor/verify-sign-in");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('FLUIDE_ACCESS_TOKEN'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => "{}",
]);
$response = curl_exec($ch);
if ($response === false) throw new RuntimeException(curl_error($ch));
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($status >= 400) throw new RuntimeException("HTTP $status: $response");
echo $response;

{}

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {}
}

{
  "success": false,
  "message": "Validation failed",
  "code": "VALIDATION_FAILED",
  "statusCode": 400,
  "timestamp": "2026-06-03T12:00:00.000Z",
  "errors": {
    "from": [
      "from must be a valid date"
    ]
  }
}

{
  "success": false,
  "message": "Validation failed",
  "code": "VALIDATION_FAILED",
  "statusCode": 400,
  "timestamp": "2026-06-03T12:00:00.000Z",
  "errors": {
    "from": [
      "from must be a valid date"
    ]
  }
}

{
  "success": false,
  "message": "Validation failed",
  "code": "VALIDATION_FAILED",
  "statusCode": 400,
  "timestamp": "2026-06-03T12:00:00.000Z",
  "errors": {
    "from": [
      "from must be a valid date"
    ]
  }
}

{
  "success": false,
  "message": "Validation failed",
  "code": "VALIDATION_FAILED",
  "statusCode": 400,
  "timestamp": "2026-06-03T12:00:00.000Z",
  "errors": {
    "from": [
      "from must be a valid date"
    ]
  }
}

POST

api

auth

two-factor

verify-sign-in

cURL

curl -sS -X POST "$FLUIDE_BASE_URL/api/v1/auth/two-factor/verify-sign-in" \
  -H "Authorization: Bearer $FLUIDE_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

const baseUrl = process.env.FLUIDE_BASE_URL;

const response = await fetch(`${baseUrl}/api/v1/auth/two-factor/verify-sign-in`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.FLUIDE_ACCESS_TOKEN}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
});

if (!response.ok) throw new Error(`HTTP ${response.status}: ${await response.text()}`);
console.log(await response.json());

import os
import requests

base_url = os.environ["FLUIDE_BASE_URL"]
headers = {
        "Authorization": f"Bearer {os.environ['FLUIDE_ACCESS_TOKEN']}",
}

response = requests.post(
    f"{base_url}/api/v1/auth/two-factor/verify-sign-in",
    headers=headers,
    json={},
    timeout=30,
)
response.raise_for_status()
print(response.json())

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

String baseUrl = System.getenv("FLUIDE_BASE_URL");
HttpClient client = HttpClient.newHttpClient();
HttpRequest.Builder builder = HttpRequest.newBuilder()
    .uri(URI.create(baseUrl + "/api/v1/auth/two-factor/verify-sign-in"))
    .header("Authorization", "Bearer " + System.getenv("FLUIDE_ACCESS_TOKEN"))
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString("{}"))
    .build();
HttpResponse<String> response = client.send(builder.build(), HttpResponse.BodyHandlers.ofString());
if (response.statusCode() >= 400) throw new RuntimeException("HTTP " + response.statusCode() + ": " + response.body());
System.out.println(response.body());

<?php
$baseUrl = getenv("FLUIDE_BASE_URL");
$ch = curl_init($baseUrl . "/api/v1/auth/two-factor/verify-sign-in");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('FLUIDE_ACCESS_TOKEN'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => "{}",
]);
$response = curl_exec($ch);
if ($response === false) throw new RuntimeException(curl_error($ch));
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($status >= 400) throw new RuntimeException("HTTP $status: $response");
echo $response;

{}

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {}
}

{
  "success": false,
  "message": "Validation failed",
  "code": "VALIDATION_FAILED",
  "statusCode": 400,
  "timestamp": "2026-06-03T12:00:00.000Z",
  "errors": {
    "from": [
      "from must be a valid date"
    ]
  }
}

{
  "success": false,
  "message": "Validation failed",
  "code": "VALIDATION_FAILED",
  "statusCode": 400,
  "timestamp": "2026-06-03T12:00:00.000Z",
  "errors": {
    "from": [
      "from must be a valid date"
    ]
  }
}

{
  "success": false,
  "message": "Validation failed",
  "code": "VALIDATION_FAILED",
  "statusCode": 400,
  "timestamp": "2026-06-03T12:00:00.000Z",
  "errors": {
    "from": [
      "from must be a valid date"
    ]
  }
}

{
  "success": false,
  "message": "Validation failed",
  "code": "VALIDATION_FAILED",
  "statusCode": 400,
  "timestamp": "2026-06-03T12:00:00.000Z",
  "errors": {
    "from": [
      "from must be a valid date"
    ]
  }
}

Authorizations

Authorization

string

header

required

Access token JWT. Use as Authorization: Bearer . In the API playground, paste the JWT only.

Body

application/json

pendingToken

string

required

Opaque token from POST /auth/sign-in when twoFactorRequired is true.

Required string length: 16 - 128

code

string

required

6-digit code from the authenticator app.

Pattern: /^\d{6}$/

fluideClientId

enum<string>

required

Available options:

fluide-admin,

fluide-capital-admin,

fluide-super,

fluide-developer,

fluide-onboarding,

fluide-pay

trustDeviceLabel

string

Optional display name for audit logs.

Maximum string length: 120

Response

The response is of type object.

Auth API

HR API

Payroll API

Pay API

Books API

Utils API

Complete password sign-in after TOTP second step (Option C JWT only)

Authorizations

Body

Response