Disable TOTP
Profile & security
Disable TOTP
Session-only. Turn off two-factor authentication. Requires both the account password and a live code; an unlocked session alone is not sufficient.
POST
Disable TOTP
Authorizations
Browser session cookie minted by POST /auth/login (or passkey
login). httpOnly, SameSite=Lax, 24 h TTL. Endpoints marked
Session-only accept only this credential and return
403 session_required for API keys.