# Regenerate recovery codes

`POST /fapi/v1/me/recovery-codes:regenerate` · called from the environment's sign-in host

Replaces the user's recovery codes with new ones; all old codes become invalid. The new codes are shown only once in this response and a security notification is sent to the user's email addresses. Requires the authenticated user's `__Host-idp_session` cookie; if the cookie is missing, expired, or revoked, returns `401 unauthenticated`. A first-party app on another origin can instead send its front API access token (`Authorization: DPoP <token>` with a DPoP proof; see [Front API access token](/docs/api/fapi/front-api-token)).

## Request

Headers:

| Header | Required | Description |
| --- | --- | --- |
| `Idp-Client` | yes | SDK identifier. |
| `Origin` | yes | Must be exactly `https://<sign-in host>`. |

Body:

```json
{}
```

## Response

`200 OK`:

```json
{"recovery_codes": ["…", "…"]}
```

## Errors

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | No valid session cookie. |
| 401 | `step_up_required` | Session was not verified in the last 5 minutes; re-verify with `max_age=300` in the `WWW-Authenticate` header. |
| 403 | `origin_not_allowed` | `Origin` is missing or wrong. |
| 404 | `not_found` | Recovery codes are disabled in the environment. |
| 409 | `conflict` | User has no second factor; recovery codes not generated. |

## Example

```bash
curl -X POST https://example.keenauth.app/fapi/v1/me/recovery-codes:regenerate \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -H "Origin: https://example.keenauth.app" \
  -H "Content-Type: application/json" \
  -d '{}' \
  -b cookies.txt
```

## Personal data

This endpoint carries personal data: credentials. [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.