Browse the docs

Validate OTP and activate card

POST /v1/public/2fa/card/activate

Step 3 of card activation: checks otp against the session and activates the card. Up to 3 attempts per session; the session is discarded after a successful activation, on expiry, or once the attempts are used up. No authentication required.

Request

Authentication: none.

Body

Field	Type	Description
`session_id` required	string, uuid	The session id (UUID) used in `POST /v1/public/2fa/card/activate/otp`. `INVALID_SESSION` if unknown or already consumed; `OTP_EXPIRED` once its 10 minutes have passed.
`otp` required	string	The 6-digit one-time code issued for the session (valid for 10 minutes; up to 3 attempts).

Example request

cURL

curl --request POST \
     --url 'https://api.themooncard.com/v1/public/2fa/card/activate' \
     --header 'content-type: application/json' \
     --data '{
       "session_id": "0d7f3a2b-5c1e-4f6a-9b8d-2e4c6a8b0d1f",
       "otp": "482913"
     }'

Responses

200 Success

Field	Type	Description
`success` required	boolean	Always `true` on a 200 response.
`message` required	string	"Card activated successfully".

JSON

{
  "success": true,
  "message": "Card activated successfully"
}

400 Error

Validation failed (errors[]), or { message, code } with INVALID_SESSION (unknown or already used session), OTP_EXPIRED, MAX_ATTEMPTS_EXCEEDED or INVALID_OTP.

The body is the standard error object: see Errors.

500 Error

Unexpected server error. Body is { message: "Internal server error", code: "INTERNAL_SERVER_ERROR" }.

The body is the standard error object: see Errors.

Last updated August 16, 2026