TwoFactorChallenge

Returned instead of a session when the user has 2FA enabled. A short-lived 2FA cookie is set; finish with /two-factor/verify-totp, /two-factor/verify-otp or /two-factor/verify-backup-code.

{
    "twoFactorRedirect": true,
    "twoFactorMethods": [
        "totp"
    ]
}