> ## Documentation Index
> Fetch the complete documentation index at: https://developers.liara.ir/llms.txt
> Use this file to discover all available pages before exploring further.

# Log in with a one-time code

> Exchanges a login code from `POST /v1/login/send-otp-token` for an API token that's valid for 30 days. Use the same `email` or `phone` the code was sent to. If two-factor authentication is enabled on your account, send the second factor in the same request.

This endpoint is rate limited. Too many requests return `429`.



## OpenAPI

````yaml /spec/platform-auth.yaml post /v1/login/verify-otp-token
openapi: 3.0.1
info:
  title: Authentication & Account
  version: 1.0.0
  description: >-
    Log in, issue API tokens, change or reset your password, set up two-factor
    authentication, verify your email address and phone number, and manage your
    account profile and billing contact details.
servers:
  - url: https://api.liara.ir
security:
  - bearerAuth: []
tags:
  - name: Login
    description: Exchange your credentials or a one-time code for an API token.
  - name: Registration
    description: Create a new account.
  - name: Password
    description: Change your password while logged in, or reset a forgotten one.
  - name: API Tokens
    description: Issue additional API tokens for your account.
  - name: Account
    description: Read and update your profile and billing contact details.
  - name: Two-Factor Authentication
    description: Set up and manage authenticator-app (TOTP) two-factor authentication.
  - name: Verification
    description: Verify, or change, your account's email address and phone number.
paths:
  /v1/login/verify-otp-token:
    post:
      tags:
        - Login
      summary: Log in with a one-time code
      description: >-
        Exchanges a login code from `POST /v1/login/send-otp-token` for an API
        token that's valid for 30 days. Use the same `email` or `phone` the code
        was sent to. If two-factor authentication is enabled on your account,
        send the second factor in the same request.


        This endpoint is rate limited. Too many requests return `429`.
      operationId: loginWithCode
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              description: Send exactly one of `email` or `phone`.
              required:
                - token
              properties:
                email:
                  type: string
                  format: email
                phone:
                  $ref: '#/components/schemas/PhoneNumber'
                token:
                  type: string
                  minLength: 6
                  maxLength: 6
                  description: The 6-digit login code.
                twoFAType:
                  $ref: '#/components/schemas/TwoFAType'
                totp:
                  $ref: '#/components/schemas/TOTPCode'
                recoveryCode:
                  $ref: '#/components/schemas/RecoveryCode'
            example:
              phone: '09120000000'
              token: '123456'
      responses:
        '200':
          description: Logged in.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/LoginResponse'
                  - type: object
                    properties:
                      email:
                        type: string
                        format: email
              example:
                email: you@example.com
                api_token: <api-token>
                fullname: نام نمونه
                avatar: https://example.com/avatar.png
        '400':
          description: >-
            The body is invalid, or two-factor authentication is enabled and
            `twoFAType` is missing (`two_fa_type_required`), or `totp` isn't
            numeric (`invalid_totp`).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: No account matches, or the code is wrong or has expired.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              example:
                statusCode: 401
                error: Unauthorized
                message: Authentication failed.
                data: null
        '403':
          description: >-
            The second factor is wrong (`two_fa_totp_invalid`,
            `two_fa_recoveryCode_invalid`, `two_fa_validation_failed`).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          $ref: '#/components/responses/TooManyRequests'
      security: []
components:
  schemas:
    PhoneNumber:
      type: string
      pattern: ^09\d{9}$
      description: Iranian mobile number in the form `09XXXXXXXXX`.
      example: '09120000000'
    TwoFAType:
      type: string
      description: >-
        Which second factor you're sending. Required when two-factor
        authentication is enabled on the account.
      enum:
        - totp
        - recoveryCode
    TOTPCode:
      type: string
      minLength: 6
      maxLength: 6
      description: >-
        6-digit code from your authenticator app. Required when `twoFAType` is
        `totp`.
    RecoveryCode:
      type: string
      minLength: 10
      maxLength: 10
      description: >-
        One of your 10-character recovery codes. Required when `twoFAType` is
        `recoveryCode`.
    LoginResponse:
      type: object
      properties:
        api_token:
          type: string
          description: 'API token to send as `Authorization: Bearer <api-token>`.'
        fullname:
          type: string
        avatar:
          type: string
          format: uri
    Error:
      type: object
      description: Standard error body.
      properties:
        statusCode:
          type: integer
        error:
          type: string
          description: HTTP status text.
        message:
          type: string
          description: What went wrong.
        data:
          type: object
          nullable: true
          description: >-
            Extra details. When present, `code` is a stable, machine-readable
            error code.
          properties:
            code:
              type: string
  responses:
    TooManyRequests:
      description: Too many requests. Wait and try again later.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            statusCode: 429
            error: Too Many Requests
            message: Too Many Requests
            data: null
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        Send your API token as `Authorization: Bearer <api-token>`. Tokens
        expire (30 days by default) and stop working when you change or reset
        your password.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.