Documentation

Reset secret

Permanently deletes the user's existing secret. Frozen status, rejection counter, and device binding are all cleared. The answer carries a new secret with its QR image and 10 new recovery codes, valid for 5 minutes: the user links their phone again with it.

POST/auth/secret/reset
Body parameters
ParameterTypeDescription
externalUsernamestringYour user ID Required
Caution: This action is irreversible. The old secret becomes invalid. The user must re-register in the mobile app.
Unfreeze: If a user has been frozen due to too many rejections, a reset also clears the frozen status.
Request
const { Touchque } = require('@touchque/node');

const tq = new Touchque({
  apiKey: 'tq_abc123',
  apiSecret: 'YOUR_API_SECRET'
});

async function resetDevice() {
  // Permanently replaces the user's current secret and returns the new one
  const reset = await tq.auth.resetSecret({
    externalUsername: 'user@yourcompany.com'
  });

  // reset = { secret, qrCodeDataUrl, recoveryCodes, expiresAt, externalUsername }
  // The new secret is valid for 5 minutes: relink the phone with reset.qrCodeDataUrl
  console.log('New secret:', reset.secret);
}

resetDevice();
Response 200
{
  "success": true,
  "secret": "A1B2C3D4E5F6A7B8C9D0E1F2",
  "qrCodeDataUrl": "data:image/png;base64,…",
  "externalUsername": "user@yourcompany.com",
  "message": "Secret reset successfully",
  "expiresAt": "2026-11-02T12:05:00.000Z",
  "recoveryCodes": ["…", "…"]
}