Removes the user’s active multi-factor credential. When requireCode is set or an email method is configured, the request must include a valid MFA code (and token for email) to confirm ownership.
Session token stored in a cookie after user signs in, prefixed with __Secure if on https
The string (id or name, depending on the credentials)
Raw MFA challenge token issued during login or setup. Required when verifying email MFA.
Indicates the origin of the token.
challenge, setup Expected MFA method for the disable request.
authenticator, email One-time passcode submitted to confirm MFA ownership.
Forces the server to verify code before disabling MFA.