Skip to main content
recoveryCodes.recover wraps the Recovery Codes Recover API endpoint. It takes a single recovery_code parameter, which is a recovery code that was previously generated for the Member. Calling the recover endpoint will consume the recovery code and authenticate the Member, minting a new session for them. Currently, recovery codes are only generated when a enrolls in TOTP as their secondary MFA factor, and as such authenticate members in place of a stytch.totps.authenticate(). If neither a Member Session nor an is present, this method will fail.

If this method succeeds, the Member will be logged in, granted an active session, and the .

Parameters

string
required
The recovery code generated by a secondary MFA method. This code is used to authenticate in place of the secondary MFA method if that method as a backup.

Response

string
The unique ID of the Member.
object
The new Stytch Session.
object
The Member object of the signed-in Member.
object
The Organization object of the Organization the Member has signed into.
string
The JWT for the new Stytch Session.
If the project is configured to use HttpOnly cookies, this field will always be an empty string.
string
The secret token for the new Stytch Session.
If the project is configured to use HttpOnly cookies, this field will always be an empty string.
object
If Protected Auth is enabled and returned fingerprinting results, this field will contain information about the member’s device attributes.
string
Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
number
The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.