Disable TOTP
curl --request POST \
--url https://aropay.aro.media/api/v1/me/totp/disable \
--header 'Content-Type: application/json' \
--cookie aropay_session= \
--data '
{
"password": "<string>",
"code": "<string>"
}
'const options = {
method: 'POST',
headers: {cookie: 'aropay_session=', 'Content-Type': 'application/json'},
body: JSON.stringify({password: '<string>', code: '<string>'})
};
fetch('https://aropay.aro.media/api/v1/me/totp/disable', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://aropay.aro.media/api/v1/me/totp/disable"
payload = {
"password": "<string>",
"code": "<string>"
}
headers = {
"cookie": "aropay_session=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"ok": true,
"data": {
"totpEnabled": false
}
}Profile & security
Disable TOTP
Session-only, with step-up. Turn off two-factor authentication.
Requires both the account password and a live code; an unlocked
session alone is not sufficient. The code is single-use (a replay
fails with 401 totp_code_reused). A wrong password counts toward
the step-up password lock, and every code tried counts toward the 2FA code
cap shared with POST /auth/login/totp (see 423).
POST
/
me
/
totp
/
disable
Disable TOTP
curl --request POST \
--url https://aropay.aro.media/api/v1/me/totp/disable \
--header 'Content-Type: application/json' \
--cookie aropay_session= \
--data '
{
"password": "<string>",
"code": "<string>"
}
'const options = {
method: 'POST',
headers: {cookie: 'aropay_session=', 'Content-Type': 'application/json'},
body: JSON.stringify({password: '<string>', code: '<string>'})
};
fetch('https://aropay.aro.media/api/v1/me/totp/disable', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://aropay.aro.media/api/v1/me/totp/disable"
payload = {
"password": "<string>",
"code": "<string>"
}
headers = {
"cookie": "aropay_session=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"ok": true,
"data": {
"totpEnabled": false
}
}Authorizations
Browser session cookie minted by POST /auth/login (or passkey
login). httpOnly, SameSite=Lax, 24 h TTL. Endpoints marked
Session-only accept only this credential and return
403 session_required for API keys.