> ## Documentation Index
> Fetch the complete documentation index at: https://vastai-80aa3a82-auto-openapi-update-f12b5ae6.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Confirm New 2FA Method

> Confirms a new SMS or TOTP 2FA method by verifying a code, enabling 2FA on the account and returning backup codes on first method addition.



## OpenAPI

````yaml /api-reference/openapi.yaml post /api/v0/tfa/confirm-new
openapi: 3.1.0
info:
  title: Vast.ai API
  description: >-
    Vast.ai REST API for managing GPU cloud instances, machine operations, and
    AI/ML workflows.


    ## AI Agent Quick-Start


    Install the CLI skill for your agent (Claude Code, Cursor, Windsurf, etc.):
      npx skills add vast-ai/vast-cli

    CLI reference:
    https://raw.githubusercontent.com/vast-ai/vast-cli/master/vastai/SKILL.md

    SDK reference:
    https://raw.githubusercontent.com/vast-ai/vast-cli/master/vastai_sdk/SKILL.md


    ## Auth

    All endpoints require `Authorization: Bearer $VAST_API_KEY`.

    Get your key at: https://cloud.vast.ai/manage-keys/


    ## Key Quirks

    - `gpu_ram` in CLI = GB; in REST API = MB (CLI auto-converts)

    - SSH keys must be registered BEFORE creating an instance (VM: no recovery;
    Docker: can add post-create)

    - `onstart` field is limited to 4048 characters -- gzip+base64 for longer
    scripts

    - `POST /api/v0/asks/{id}/` (create instance) returns `new_contract` as the
    instance ID, not `id`

    - Poll trap: if `actual_status` becomes `exited`, `unknown`, or `offline` it
    will never reach `running` -- destroy and retry
  version: 1.0.0
  contact:
    name: Vast.ai Support
    url: https://discord.gg/vast
  license:
    name: Vast.ai Terms of Service
    url: https://vast.ai/terms/
servers:
  - url: https://console.vast.ai
    description: Production server
security:
  - BearerAuth: []
paths:
  /api/v0/tfa/confirm-new:
    post:
      tags:
        - Accounts
      summary: Confirm New 2FA Method
      description: >-
        Confirms a new SMS or TOTP 2FA method by verifying a code, enabling 2FA
        on the account and returning backup codes on first method addition.
      operationId: confirmNew2FAMethod
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                code:
                  type: string
                  description: Verification code from the new 2FA method being confirmed
                  example: '123456'
                secret:
                  type: string
                  description: >-
                    The tfa_secret returned when the code was sent (SMS) or the
                    TOTP secret from the setup step
                  example: abc123secret
                tfa_method:
                  type: string
                  description: >-
                    Type of two-factor authentication method being confirmed;
                    defaults to 'sms' when a phone number is provided.
                  example: totp
                  enum:
                    - sms
                    - totp
                phone_number:
                  type: string
                  description: >-
                    Phone number for SMS methods; falls back to account's
                    registered number
                  example: '+14155550123'
                label:
                  type: string
                  description: Optional display name for this method
                  example: Personal Phone
      responses:
        '200':
          description: >-
            Returns {success: true, msg: "{METHOD} 2FA method added
            successfully."} and includes backup_codes: [...] if this is the
            user's first 2FA method.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    description: Always true on success
                  msg:
                    type: string
                    description: >-
                      Confirmation message, e.g. "SMS 2FA method added
                      successfully."
                  backup_codes:
                    type: array
                    description: >-
                      Plaintext backup codes (returned only when this is the
                      user's first ever 2FA method); store securely — shown only
                      once
                    items:
                      type: string
              example:
                success: true
                msg: SMS 2FA method added successfully.
                backup_codes:
                  - ABCD-EFGH-IJKL
                  - MNPQ-RSTU-VWXY
        '400':
          description: >-
            Missing code or secret ("missing_auth_value"), invalid tfa_method
            ("invalid_tfa_method"), untracked legacy 2FA found
            ("untracked_2fa_found"), duplicate method ("duplicate_tfa_method"),
            or invalid 2FA code ("2fa_verification_failed").
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: User is not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: >-
            Authorization not completed ("authorization_required") or team user
            in team context ("team_user_forbidden").
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '503':
          description: >-
            Authorization service temporarily unavailable
            ("service_unavailable").
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - BearerAuth: []
components:
  schemas:
    Error:
      type: object
      properties:
        error:
          type: string
        msg:
          type: string
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: API key must be provided in the Authorization header

````