Reset Recovery Key

POST /api/v1/auth/recovery-key
Content-Type: application/json

Issues a new recovery token, replacing the previous one. Requires an active session_token and, when 2FA is enabled, a valid TOTP code.

Request

{
  "password": "••••••••",
  "code": "000000"
}

Field	Required	Description
`password`	Yes	Current account password.
`code`	Conditional	Valid TOTP code from the authenticator. Required when 2FA is enabled. Recovery codes are explicitly refused here — a recovery code must not be spendable to mint a fresh master credential.

{
  "success": true,
  "response": {
    "data": {
      "recoveryKey": "frostauth-rt-NEW_KEY_HERE..."
    }
  }
}

{
  "error": true,
  "response": {
    "code": 400,
    "message": "Use a code from your authenticator, not a recovery code"
  }
}

{
  "error": true,
  "response": {
    "code": 401,
    "message": "Not authenticated"
  }
}

{
  "error": true,
  "response": {
    "code": 404,
    "message": "User doesn't exist"
  }
}

{
  "error": true,
  "response": {
    "code": 429,
    "message": "Too many requests"
  }
}

{
  "error": true,
  "response": {
    "code": 500,
    "message": "Failed to reissue the recovery key"
  }
}

Layer	Limit	Keyed by
2FA limiter	10 per 1 min	Account
Per-identity backoff	Applies to password/code failures	Account

HTTP	Message	Cause
`400`	`Use a code from your authenticator, not a recovery code`	A recovery code was supplied instead of TOTP.
`401`	`Not authenticated`	No valid session cookie.
`401`	`Your password is incorrect`	Password verification failed.
`401`	`Invalid two-factor code`	TOTP code doesn’t match.
`404`	`User doesn't exist`	Session’s user ID not found in database.
`429`	`Too many requests`	10 per minute per account.
`500`	`Failed to reissue the recovery key`	Unhandled exception.