Push a 2FA code or sign-in link
For a password with codeSource "push": the code (or sign-in link) the site sent by email or SMS. Used once, by a wait that began before it arrived (a run typing %NAME.otp%, opening %NAME.link%, a type action, a login action or boxline-otp); kept sealed at most 10 minutes (at most 10 per credential). A link must be on one of the credential's sites (400 credential_link_wrong_site). Audited (action "code", never the value); counts as a credential write (60 per minute per project).
/v1/credentials/{name}/codesRequest
| Method and path | POST/v1/credentials/{name}/codes |
|---|---|
| Base URL | https://api.boxline.dev |
| Authentication | Your API key in the x-api-key header (or Authorization: Bearer). The examples read it from BOXLINE_API_KEY. |
| Rate limit | Yes. See Rate limits for the numbers and headers. |
Path parameters
| Name | Type | Default | Allowed values | Description |
|---|---|---|---|---|
namerequired | string | – | – | Up to 64 characters. Pattern: ^[A-Z_][A-Z0-9_]*$. |
Body
JSON with content-type: application/json. Required.
| Name | Type | Default | Allowed values | Description |
|---|---|---|---|---|
coderequired | string | – | – | No spaces or control characters. 1 to 64 characters. |
curl -X POST "https://api.boxline.dev/v1/credentials/$CREDENTIAL_NAME/codes" \ -H "x-api-key: $BOXLINE_API_KEY" \ -H "content-type: application/json" \ -d '{"code": "123456"}'import { Boxline } from "@boxline/sdk";const bx = new Boxline(); // reads BOXLINE_API_KEY and BOXLINE_API_URLconst accepted = await bx.credentials.pushCode("SHOP", { code: "123456" });console.log(accepted.kind, accepted.expiresAt);from boxline import Boxlinebx = Boxline() # reads BOXLINE_API_KEY and BOXLINE_API_URLaccepted = bx.credentials.push_code("SHOP", code="123456")print(accepted["kind"], accepted["expiresAt"])# The code (or a link) is read from a hidden prompt or stdin, never an argument.printf %s "$CODE" | boxline credentials push-code SHOPResponses
202
Kept for the wait.
Fields
| Name | Type | Default | Allowed values | Description |
|---|---|---|---|---|
accepted | boolean | – | true | |
kind | string | – | code, link | |
expiresAt | string | – | – | Format: date-time. |
{ "accepted": true, "kind": "code", "expiresAt": "2026-09-29T10:00:00.000Z"}Errors
Errors have a matching HTTP status and the same body. code is stable, so check it in your code; message is for people. See Errors and request ids.
| Status | Codes | When |
|---|---|---|
| 400 Bad Request | invalid_request, invalid_json, invalid_cursor, invalid_idempotency_key, invalid_extension, variables_with_extensions, terms_not_accepted, invalid_reset_token, invalid_confirmation_code, wrong_password, no_password, invalid_next, invalid_oauth_token | The request is not valid. |
| 401 Unauthorized | unauthorized | Missing or invalid API key. |
| 402 Payment Required | feature_not_in_plan, spend_limit, out_of_credit, plan_limit, spend_limit, out_of_credit, organization, project, plan, credit | The plan does not include this, a monthly allowance or spending limit is used up, the organization has no credit left, or the plan allows no more of this. spend_limit and out_of_credit carry error.details.limit: organization, project, plan or credit. |
| 404 Not Found | not_found, invite_not_found, provider_unavailable | No such thing in this project (or organization), or no such route. |
| 429 Too Many Requests | rate_limited, concurrency_limit | Too many requests, or the organization's concurrent sessions (its plan's) or the project's concurrencyCap are in use. |
{ "error": { "code": "not_found", "message": "session not found", "requestId": "req_4fJx0aQm2Lk9Pz7N" }}Learn more
These docs describe a beta API. Endpoints, fields and SDK methods may change before general availability; breaking changes will be listed in the changelog.