# Dashboard JWT only - an API key gets 403 JWT_REQUIRED
curl https://api.liddie.io/api/v1/conversions/mfa-options \
-H "Cookie: <dashboard session cookies>"
// Dashboard JWT session only — send the JWT as a Bearer token
// (an API key gets 403 JWT_REQUIRED)
const res = await fetch('https://api.liddie.io/api/v1/conversions/mfa-options', {
headers: { Authorization: 'Bearer <dashboard JWT>' }
})
const { hasPasskeys, hasTotp, preferredMethod } = await res.json()
{ "hasPasskeys": true, "hasTotp": true, "preferredMethod": "passkey" }
Conversions
Get MFA options
List the MFA factors — TOTP or passkey — that the current dashboard user can present when executing a crypto currency conversion in the Liddie API.
GET
/
api
/
v1
/
conversions
/
mfa-options
# Dashboard JWT only - an API key gets 403 JWT_REQUIRED
curl https://api.liddie.io/api/v1/conversions/mfa-options \
-H "Cookie: <dashboard session cookies>"
// Dashboard JWT session only — send the JWT as a Bearer token
// (an API key gets 403 JWT_REQUIRED)
const res = await fetch('https://api.liddie.io/api/v1/conversions/mfa-options', {
headers: { Authorization: 'Bearer <dashboard JWT>' }
})
const { hasPasskeys, hasTotp, preferredMethod } = await res.json()
{ "hasPasskeys": true, "hasTotp": true, "preferredMethod": "passkey" }
Dashboard helper: which factors the current user can present for the execute step.
JWT only — MFA factors belong to a dashboard user, so an API-key caller gets
403 JWT_REQUIRED. API-key integrations don’t need it: they authorize the execute step with the key itself. The factor is verified and consumed inside POST / — there is no separate pre-check endpoint, on purpose (that would open a replay window).
This endpoint takes no parameters — the factors are inferred from your dashboard session.
Authorization
Dashboard JWT with theconversions:view permission; the session must belong to a merchant_admin, merchant_member or super_admin role. An API key is refused with 403 JWT_REQUIRED. See the Authentication guide.
Rate limit: 30/min.
Call this right before rendering the MFA prompt to decide which factor to ask for (
preferredMethod). Don’t try to verify the factor separately first — it is verified and consumed inside POST /, and a pre-check would open a replay window.# Dashboard JWT only - an API key gets 403 JWT_REQUIRED
curl https://api.liddie.io/api/v1/conversions/mfa-options \
-H "Cookie: <dashboard session cookies>"
// Dashboard JWT session only — send the JWT as a Bearer token
// (an API key gets 403 JWT_REQUIRED)
const res = await fetch('https://api.liddie.io/api/v1/conversions/mfa-options', {
headers: { Authorization: 'Bearer <dashboard JWT>' }
})
const { hasPasskeys, hasTotp, preferredMethod } = await res.json()
{ "hasPasskeys": true, "hasTotp": true, "preferredMethod": "passkey" }
Response fields
boolean
Whether the current user has at least one passkey registered.
boolean
Whether the current user has TOTP enabled.
string
"otp" or "passkey" (defaults to "otp").Errors
| Status | Body | Why |
|---|---|---|
| 403 | { "ok": false, "error": { "code": "JWT_REQUIRED", "message": "…" } } | Called with an API key; this endpoint is dashboard-only. |
| 401 | { "ok": false, "error": { "code": "USER_NOT_FOUND", "message": "…" } } | Session user no longer exists. |
See also
- Execute a conversion: where the factor reported here is actually presented and consumed.
- Authentication guide: dashboard JWT sessions versus API keys.
- Conversions Overview: the full authorization matrix for the conversion endpoints.