vast-ai · Azaeres · May 7, 2026
diff --git a/cli/reference/tfa-activate.mdx b/cli/reference/tfa-activate.mdx
@@ -0,0 +1,63 @@
+---
+title: "vastai tfa activate"
+sidebarTitle: "tfa activate"
+---
+
+Activate a new 2FA method by verifying the code. Run `vastai tfa auth-new` before this command to authorize adding a new method.
+
+## Usage
+
+```bash
+vastai tfa activate CODE --secret SECRET [--method-type METHOD_TYPE] [--phone-number PHONE_NUMBER] [--label LABEL]
+```
+
+## Arguments
+
+<ParamField path="code" type="string" required>
+  6-digit verification code from SMS or Authenticator app.
+</ParamField>
+
+## Options
+
+<ParamField path="--secret" type="string" required>
+  Secret token from the setup process. For TOTP, obtained from `vastai tfa totp-setup`. For SMS, obtained from `vastai tfa send-sms`.
+</ParamField>
+
+<ParamField path="--method-type" type="string">
+  New 2FA method type to activate. Choices: `sms`, `totp`. Treated as `totp` when neither this flag nor `--phone-number` is supplied.
+</ParamField>
+
+<ParamField path="--phone-number" type="string">
+  Phone number for SMS method in E.164 format (e.g., `+12345678901`). Required when activating an SMS method.
+</ParamField>
+
+<ParamField path="--label" type="string">
+  Friendly label for the new 2FA method (e.g., "Work Authenticator").
+</ParamField>
+
+## Examples
+
+```bash
+# Activate TOTP (Authenticator app)
+vastai tfa activate --method-type totp --secret abc123def456 123456
+
+# Activate SMS
+vastai tfa activate --method-type sms --secret abc123def456 --phone-number +12345678901 123456
+
+# Activate SMS with a label
+vastai tfa activate --method-type sms --secret abc123def456 --phone-number +12345678901 --label "Work Phone" 123456
+```
+
+If this is your **first** 2FA method, backup codes are generated and displayed after activation. Save them in a secure location.
+
+## Global Options
+
+The following options are available for all commands:
+
+| Option | Description |
+| --- | --- |
+| `--url URL` | Server REST API URL |
+| `--retry N` | Retry limit |
+| `--raw` | Output machine-readable JSON |
+| `--explain` | Verbose explanation of API calls |
+| `--api-key KEY` | API key (defaults to `~/.config/vastai/vast_api_key`) |
diff --git a/cli/reference/tfa-auth-new.mdx b/cli/reference/tfa-auth-new.mdx
@@ -0,0 +1,68 @@
+---
+title: "vastai tfa auth-new"
+sidebarTitle: "tfa auth-new"
+---
+
+Authorize your account to add a new 2FA method. This step is required before running `vastai tfa activate`. For your first method, verification defaults to email. For subsequent methods, use an existing 2FA method.
+
+## Usage
+
+```bash
+vastai tfa auth-new {[--method-type METHOD_TYPE | --method-id ID | --backup-code BACKUP_CODE] | [--secret SECRET --code CODE]}
+```
+
+## Options
+
+<ParamField path="--method-type" type="string">
+  2FA method type to use for authorization. Choices: `email`, `sms`, `totp`. Defaults to `email`. Only use when you have exactly one method of this type.
+</ParamField>
+
+<ParamField path="--method-id" type="string">
+  2FA method ID to use if you have more than one of the same type. Get the ID from `vastai tfa status`.
+</ParamField>
+
+<ParamField path="--backup-code" type="string">
+  One-time backup code. Using a backup code immediately authorizes without an interactive code prompt.
+</ParamField>
+
+<ParamField path="--secret" type="string">
+  Secret token from a previous incomplete authorization attempt. Use with `--code` to resume.
+</ParamField>
+
+<ParamField path="--code" type="string">
+  2FA code from a previous incomplete authorization attempt. Use with `--secret` to resume.
+</ParamField>
+
+## Examples
+
+```bash
+# Default: authorize via email (use for first 2FA method)
+vastai tfa auth-new
+
+# Authorize via TOTP (existing Authenticator app)
+vastai tfa auth-new --method-type totp
+
+# Authorize via SMS
+vastai tfa auth-new -t sms
+
+# Authorize using a specific method ID
+vastai tfa auth-new --method-id 456
+
+# Authorize with backup code (no interactive prompt)
+vastai tfa auth-new --backup-code ABCD-EFGH-IJKL
+
+# Resume a previous incomplete authorization
+vastai tfa auth-new --secret abc123def456 --code 123456
+```
+
+## Global Options
+
+The following options are available for all commands:
+
+| Option | Description |
+| --- | --- |
+| `--url URL` | Server REST API URL |
+| `--retry N` | Retry limit |
+| `--raw` | Output machine-readable JSON |
+| `--explain` | Verbose explanation of API calls |
+| `--api-key KEY` | API key (defaults to `~/.config/vastai/vast_api_key`) |
diff --git a/cli/reference/tfa-delete.mdx b/cli/reference/tfa-delete.mdx
@@ -0,0 +1,71 @@
+---
+title: "vastai tfa delete"
+sidebarTitle: "tfa delete"
+---
+
+Remove a 2FA method from your account. Requires 2FA verification to authorize the deletion.
+
+## Usage
+
+```bash
+vastai tfa delete [--id-to-delete ID] [--code CODE] [--method-type METHOD_TYPE] [--secret SECRET] [--backup-code BACKUP_CODE] [--method-id ID]
+```
+
+## Options
+
+<ParamField path="--id-to-delete" type="integer">
+  ID of the 2FA method to delete. Get the ID from `vastai tfa status`. If omitted, the system attempts to delete the method you are using to authenticate — specify this flag explicitly when you have multiple methods to avoid ambiguity.
+</ParamField>
+
+<ParamField path="--code" type="string">
+  2FA code from your Authenticator app, SMS, or Email to authorize the deletion. Exactly one of `--code` or `--backup-code` is required.
+</ParamField>
+
+<ParamField path="--backup-code" type="string">
+  One-time backup code to authorize the deletion. Exactly one of `--code` or `--backup-code` is required.
+</ParamField>
+
+<ParamField path="--method-type" type="string">
+  2FA method type to use for authorization. Choices: `email`, `sms`, `totp`. Only use when you have exactly one method of this type.
+</ParamField>
+
+<ParamField path="--secret" type="string">
+  Secret token required when authorizing with `--method-type sms` or `--method-type email`. Obtain from `vastai tfa send-sms` or `vastai tfa send-email`.
+</ParamField>
+
+<ParamField path="--method-id" type="string">
+  ID of the 2FA method to use for authorization if you have more than one of the same type. Get the ID from `vastai tfa status`.
+</ParamField>
+
+## Examples
+
+```bash
+# Delete method #123, authorize with TOTP
+vastai tfa delete --id-to-delete 123 --method-type totp --code 456789
+
+# Delete method #123, authorize with backup code
+vastai tfa delete --id-to-delete 123 --backup-code ABCD-EFGH-IJKL
+
+# Delete method #123, authorize with SMS (get secret from send-sms first)
+vastai tfa delete --id-to-delete 123 --method-type sms --secret abc123def456 --code 456789
+
+# Delete method #123, authorize with Email (get secret from send-email first)
+vastai tfa delete --id-to-delete 123 --method-type email --secret abc123def456 --code 456789
+
+# Specify which TOTP method to use for authorization if you have multiple
+vastai tfa delete --id-to-delete 123 --method-id 456 --code 456789
+```
+
+**Warning:** Deleting your last 2FA method fully disables 2FA and invalidates all backup codes.
+
+## Global Options
+
+The following options are available for all commands:
+
+| Option | Description |
+| --- | --- |
+| `--url URL` | Server REST API URL |
+| `--retry N` | Retry limit |
+| `--raw` | Output machine-readable JSON |
+| `--explain` | Verbose explanation of API calls |
+| `--api-key KEY` | API key (defaults to `~/.config/vastai/vast_api_key`) |
diff --git a/cli/reference/tfa-login.mdx b/cli/reference/tfa-login.mdx
@@ -0,0 +1,62 @@
+---
+title: "vastai tfa login"
+sidebarTitle: "tfa login"
+---
+
+Complete 2FA login by verifying your identity with a 2FA code or backup code. On success, saves the session key to `~/.config/vastai/vast_tfa_key`.
+
+## Usage
+
+```bash
+vastai tfa login [--code CODE] [--method-type METHOD_TYPE] [--secret SECRET] [--backup-code BACKUP_CODE] [--method-id ID]
+```
+
+## Options
+
+<ParamField path="--code" type="string">
+  2FA code from Authenticator app, SMS, or Email. Exactly one of `--code` or `--backup-code` is required.
+</ParamField>
+
+<ParamField path="--backup-code" type="string">
+  One-time backup code (alternative to regular 2FA code). Exactly one of `--code` or `--backup-code` is required.
+</ParamField>
+
+<ParamField path="--method-type" type="string">
+  2FA method type. Choices: `email`, `sms`, `totp`. Only use when you have exactly one method of this type.
+</ParamField>
+
+<ParamField path="--secret" type="string">
+  Secret token from the previous login step. Required for SMS or Email 2FA (obtained from `tfa send-sms` or `tfa send-email`).
+</ParamField>
+
+<ParamField path="--method-id" type="string">
+  2FA method ID if you have more than one of the same type. Get the ID from `vastai tfa status`.
+</ParamField>
+
+## Examples
+
+```bash
+# Login with TOTP (Authenticator app)
+vastai tfa login --method-type totp -c 123456
+
+# Login with SMS (get code and secret from send-sms first)
+vastai tfa login --method-type sms --code 123456 --secret abc123def456
+
+# Login with Email
+vastai tfa login -t email -c 123456 -s abc123def456
+
+# Login with backup code
+vastai tfa login --backup-code ABCD-EFGH-IJKL
+```
+
+## Global Options
+
+The following options are available for all commands:
+
+| Option | Description |
+| --- | --- |
+| `--url URL` | Server REST API URL |
+| `--retry N` | Retry limit |
+| `--raw` | Output machine-readable JSON |
+| `--explain` | Verbose explanation of API calls |
+| `--api-key KEY` | API key (defaults to `~/.config/vastai/vast_api_key`) |
diff --git a/cli/reference/tfa-regen-codes.mdx b/cli/reference/tfa-regen-codes.mdx
@@ -0,0 +1,61 @@
+---
+title: "vastai tfa regen-codes"
+sidebarTitle: "tfa regen-codes"
+---
+
+Generate a new set of backup codes. Requires 2FA verification.
+
+## Usage
+
+```bash
+vastai tfa regen-codes [--code CODE] [--method-type METHOD_TYPE] [--secret SECRET] [--backup-code BACKUP_CODE] [--method-id ID]
+```
+
+## Options
+
+<ParamField path="--code" type="string">
+  2FA code from your Authenticator app, SMS, or Email. Exactly one of `--code` or `--backup-code` is required.
+</ParamField>
+
+<ParamField path="--backup-code" type="string">
+  One-time backup code to authorize regeneration. Exactly one of `--code` or `--backup-code` is required.
+</ParamField>
+
+<ParamField path="--method-type" type="string">
+  2FA method type to use for verification. Choices: `email`, `sms`, `totp`. Only use when you have exactly one method of this type.
+</ParamField>
+
+<ParamField path="--secret" type="string">
+  Secret token required when verifying with `--method-type sms` or `--method-type email`. Obtain from `vastai tfa send-sms` or `vastai tfa send-email`.
+</ParamField>
+
+<ParamField path="--method-id" type="string">
+  ID of the 2FA method to use for verification if you have more than one of the same type. Get the ID from `vastai tfa status`.
+</ParamField>
+
+## Examples
+
+```bash
+# Verify with TOTP (Authenticator app)
+vastai tfa regen-codes --code 123456 --method-type totp
+
+# Verify with SMS (get secret from send-sms first)
+vastai tfa regen-codes --code 123456 --method-type sms --secret abc123def456
+
+# Verify with a backup code
+vastai tfa regen-codes --backup-code ABCD-EFGH-IJKL
+```
+
+**Warning:** Regenerating codes immediately invalidates all existing backup codes. Save the new codes in a secure location — they are not shown again.
+
+## Global Options
+
+The following options are available for all commands:
+
+| Option | Description |
+| --- | --- |
+| `--url URL` | Server REST API URL |
+| `--retry N` | Retry limit |
+| `--raw` | Output machine-readable JSON |
+| `--explain` | Verbose explanation of API calls |
+| `--api-key KEY` | API key (defaults to `~/.config/vastai/vast_api_key`) |
diff --git a/cli/reference/tfa-resend-sms.mdx b/cli/reference/tfa-resend-sms.mdx
@@ -0,0 +1,44 @@
+---
+title: "vastai tfa resend-sms"
+sidebarTitle: "tfa resend-sms"
+---
+
+Resend an SMS 2FA verification code. Use this if you didn't receive the original code or it expired.
+
+## Usage
+
+```bash
+vastai tfa resend-sms --secret SECRET [--phone-number PHONE_NUMBER]
+```
+
+## Options
+
+<ParamField path="--secret" type="string" required>
+  Secret token from the original `vastai tfa send-sms` request.
+</ParamField>
+
+<ParamField path="--phone-number" type="string">
+  Phone number to resend the code to in E.164 format (e.g., `+12345678901`). If omitted, uses the phone number from the original request.
+</ParamField>
+
+## Examples
+
+```bash
+# Resend to the same phone number as the original request
+vastai tfa resend-sms --secret abc123def456
+
+# Resend to a specific phone number
+vastai tfa resend-sms --secret abc123def456 --phone-number +12345678901
+```
+
+## Global Options
+
+The following options are available for all commands:
+
+| Option | Description |
+| --- | --- |
+| `--url URL` | Server REST API URL |
+| `--retry N` | Retry limit |
+| `--raw` | Output machine-readable JSON |
+| `--explain` | Verbose explanation of API calls |
+| `--api-key KEY` | API key (defaults to `~/.config/vastai/vast_api_key`) |