@andrzej-taramina Usually, when we see 403s on the hosted backend, the root cause ends up being an origin issue.
The endpoint calls need to originate from the same domain the FusionAuth instance lives at
There's some CORS information in this section of the hosted backend docs: https://fusionauth.io/docs/apis/hosted-backend#prerequisites
In reading through this post, one of the first things that jumps to mind for me is that between those versions of FA, DPoP was introduced into both FusionAuth and the SDKs.
When first using DPoP in the SDKs (I did it in React), I ran into 401s for /app/me due to not running the requests with the additional DPoP headers.
Depending on your use case, it might make sense to switch from /app/me to using the userInfo property that comes from the SDK.
import { useFusionAuth } from "@fusionauth/vue-sdk";
const {
userInfo,
} = useFusionAuth();
userInfo has most (maybe all) of what's available on /app/me and is also a more efficient fetch for it.
Hey @sameer-syedmanzur!
If you're on any paid plan, I'd recommend looking at our Generic Messengers.
When the generic messenger is hit, it fires off a request to any HTTP endpoint you want. You can then use any method you need to to get the code to the user or post it back to the API to complete the 2nd factor.
If you're on the Community edition (free version), that's not accessible to you, though.
For solution on the community edition, check out this doc if you haven't read it yet: https://fusionauth.io/docs/lifecycle/authenticate-users/multi-factor-authentication#build-your-own-interface
That's how you set up a custom interface for TOTP. That would be the best-practice way of doing 2fa without smtp on community edition. I haven't done anything TOTP-based for testing, but I'd wager there's a TOTP application with an API that could handle this.
Depending on the use case, it might also make sense to set up something simple with something like MailTrap to do testing via SMTP instead of going through all this. That may be a problem depending on the use case, though