# Disable 2FA
## Endpoint
`/api/user/2fa/disable`
## Method
GET
## Description
Disables two-factor authentication for the current logged in user account.
## Parameters
| `token` | string | Yes | - | The session token generated **only** by the `login` call (API tokens from `createToken` cannot be used). |
## Authentication
Requires a session token from the `login` call ONLY. API tokens from `createToken` are not permitted.
## Response Fields
| `status` | string | `"ok"` on success. |
## Conditional Logic Notes
- Only login session tokens are accepted; API tokens cannot be used.
- No TOTP code is required to disable 2FA -- only a valid login session token is needed.
## Edge Cases
- Unlike the Enable 2FA endpoint, this does NOT require a `totp` parameter. The authenticated session token is sufficient authorization to disable 2FA.
- Calling this when 2FA is already disabled is not explicitly documented -- it may succeed silently or return an error.
- After disabling 2FA, the `login` endpoint will no longer require the `totp` parameter for this user.