bug: Usage to complete MFA on login doesn't work as documented #14

New Issue

2026-02-16T12:28:58-05:00

yindo commented

2026-02-16 12:28:58 -05:00

Originally created by @MasicoreLord on GitHub (Apr 14, 2023).

What happened?

On this page:
https://developers.revolt.chat/api/#tag/Session/operation/login_login

On the first request sample, where it shows what to do to fufil mfa as copied here:

{
  "mfa_ticket": "string",
  "mfa_response": {
    "password": "string"
  },
  "friendly_name": "string"
}

It'd throw error code 400 (Bad Request)

Turns out when inspecting network traffic from Revite, where it'd say password, it actually uses a field named "totp_code", which did work as intended and generated a new login session.

Originally created by @MasicoreLord on GitHub (Apr 14, 2023). ### What happened? On this page: https://developers.revolt.chat/api/#tag/Session/operation/login_login On the first request sample, where it shows what to do to fufil mfa as copied here: ```json { "mfa_ticket": "string", "mfa_response": { "password": "string" }, "friendly_name": "string" } ``` It'd throw error code 400 (Bad Request) Turns out when inspecting network traffic from Revite, where it'd say password, it actually uses a field named "totp_code", which did work as intended and generated a new login session.

yindo added the bug label 2026-02-16 12:28:58 -05:00

yindo closed this issue

2026-02-16 12:28:58 -05:00

yindo commented

2026-02-16 12:28:58 -05:00

@Zomatree commented on GitHub (Apr 14, 2023):

You can only do the MFA variants which are in the initial login response under the allowed_methods key, if "Password" is not in that list then you cannot attempt to do password MFA.

The docs show this here:

@Zomatree commented on GitHub (Apr 14, 2023): You can only do the MFA variants which are in the initial login response under the `allowed_methods` key, if `"Password"` is not in that list then you cannot attempt to do password MFA. The docs show this here: ![chrome_qnfS9rLklD](https://user-images.githubusercontent.com/39768508/232176338-890ea899-5b65-47dd-9f84-5e4a9437dba7.png) ![chrome_Y8hJO1Dnjz](https://user-images.githubusercontent.com/39768508/232176318-887aea9e-2511-472d-936a-ab96d9dea600.png)

yindo commented

2026-02-16 12:28:58 -05:00

@MasicoreLord commented on GitHub (Apr 14, 2023):

You can only do the MFA variants which are in the initial login response under the allowed_methods key, if "Password" is not in that list then you cannot attempt to do password MFA.

The docs show this here:

Oh I see, the docs were not very clear on that, lol, also from that I realized I got to also handle the case a user would want to enter their recovery code.

@MasicoreLord commented on GitHub (Apr 14, 2023): > You can only do the MFA variants which are in the initial login response under the `allowed_methods` key, if `"Password"` is not in that list then you cannot attempt to do password MFA. > > The docs show this here: ![chrome_qnfS9rLklD](https://user-images.githubusercontent.com/39768508/232176338-890ea899-5b65-47dd-9f84-5e4a9437dba7.png) ![chrome_Y8hJO1Dnjz](https://user-images.githubusercontent.com/39768508/232176318-887aea9e-2511-472d-936a-ab96d9dea600.png) Oh I see, the docs were not very clear on that, lol, also from that I realized I got to also handle the case a user would want to enter their recovery code.

yindo commented

2026-02-16 12:28:58 -05:00

@MasicoreLord commented on GitHub (Apr 14, 2023):

Didn't see that second any of section from my view, so that explains my confusion:

@MasicoreLord commented on GitHub (Apr 14, 2023): Didn't see that second any of section from my view, so that explains my confusion: ![image](https://user-images.githubusercontent.com/11468845/232178448-637ec0db-859e-458c-bcc8-045d849b56e7.png)

yindo commented

2026-02-16 12:28:58 -05:00

@MasicoreLord commented on GitHub (Apr 14, 2023):

I made a user errror in using the docs, and didn't think to use the drop down under mfa_response to see the options.

@MasicoreLord commented on GitHub (Apr 14, 2023): I made a user errror in using the docs, and didn't think to use the drop down under mfa_response to see the options.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: stoatchat/javascript-client-api#14