TOTP API login workflow

Checklist

• Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
  • Yes
• Are you sure you're not using someone else's docker image?
  • Yes
• Have you searched for similar issues (both open and closed)?
  • Yes

Describe the bug
How works the API login workflow after enabled the TOTP?

Nginx Proxy Manager Version
v2.13.6

Additional context
When call the /api/tokens when a user have the 2fa, I got:

[
  {
    "requires_2fa": true,
    "challenge_token": "REDACTED"
  }
]

Before:

[
  {
    "token": "REDACTED",
    "expires": "2026-01-21T08:40:58.825Z"
  }
]

@piotrfx how proceed from to get the token to use the API? I have to keep the 2fa turned off to use the API or is possible to send the code somehow?

PS: will be nice to have API token in NPM to allow use the API.

The issue identifies /api/tokens as the entry point and shows the requires_2fa/challenge_token response. Start by tracing that API workflow in the repository and checking any existing API authentication documentation. Done means the TOTP follow-up request and token retrieval are explicitly documented, or the issue is narrowed to a concrete implementation change.