How can I handle Multi-Factor Authentication (MFA)?

Belvo supports the connection to institutions where a 2FA or OTP (One Time Password) is needed.

When you are trying to retrieve information from the institution through a POST call to Belvo, you can add the 2FA inside the call by adding a "token" field inside the body request.

However, if you don't add the 2FA and it is needed to perform the call you are trying to make, you will receive a 428 error asking you to submit the token. The content of the error will be similar to this:

{
"detail": "Token Required",
"session": "2675b703b9d4451f8d4861a3eee54449",
"expiry": 9600,
"link": "30cb4806-6e00-48a4-91c9-ca55968576c8"
}

Once you have the token value, you can use the link and the session from the response above to send a new PATCH request to the Resume endpoint:

curl -X PATCH \
 https://api.belvo.co/api/links/ \
 -H 'Content-Type: application/json' \
 -H 'Host: api.belvo.co' \
 -H 'cache-control: no-cache' \
 -d '{
 "session": "2675b703b9d4451f8d4861a3eee54449",
 "token": "12345",
 "link": "30cb4806-6e00-48a4-91c9-ca55968576c8"
}' \
 -u [Secret Key ID]:[Secret Key PASSWORD]

For more details, you can access our MFA-handling page in our getting started guide.