reverification_required

When it happens

Sensitive account changes (password, email addresses, two-step verification, passkeys, connected accounts, deleting the account) need a recent verification: the second factor (or the first, for a user without one) within the last 10 minutes. The problem’s reverification member says what would satisfy it:

{ "code": "reverification_required", "reverification": { "level": "second_factor", "after_minutes": 10 } }

Your own backend sends the same body from @zautha/backend, @zautha/nextjs or Zautha.AspNetCore when you protect an endpoint with a reverification requirement.

What to do

useReverification (@zautha/react) recognizes it, asks the user to verify and retries the action. With @zautha/js, catch ReverificationRequiredError and run a session verification at its requirement.level.