diff --git a/.changeset/angry-boxes-tie.md b/.changeset/angry-boxes-tie.md
new file mode 100644
index 00000000000..253b55e59cb
--- /dev/null
+++ b/.changeset/angry-boxes-tie.md
@@ -0,0 +1,5 @@
+---
+"@atproto/api": patch
+---
+
+Add authFactorToken to session objects
diff --git a/packages/api/src/agent.ts b/packages/api/src/agent.ts
index bec2834e9e3..17ef3b978bd 100644
--- a/packages/api/src/agent.ts
+++ b/packages/api/src/agent.ts
@@ -148,6 +148,7 @@ export class AtpAgent {
         did: res.data.did,
         email: opts.email,
         emailConfirmed: false,
+        emailAuthFactor: false,
       }
       this._updateApiEndpoint(res.data.didDoc)
       return res
@@ -173,6 +174,7 @@ export class AtpAgent {
       const res = await this.api.com.atproto.server.createSession({
         identifier: opts.identifier,
         password: opts.password,
+        authFactorToken: opts.authFactorToken,
       })
       this.session = {
         accessJwt: res.data.accessJwt,
@@ -181,6 +183,7 @@ export class AtpAgent {
         did: res.data.did,
         email: res.data.email,
         emailConfirmed: res.data.emailConfirmed,
+        emailAuthFactor: res.data.emailAuthFactor,
       }
       this._updateApiEndpoint(res.data.didDoc)
       return res
@@ -215,6 +218,7 @@ export class AtpAgent {
       this.session.email = res.data.email
       this.session.handle = res.data.handle
       this.session.emailConfirmed = res.data.emailConfirmed
+      this.session.emailAuthFactor = res.data.emailAuthFactor
       this._updateApiEndpoint(res.data.didDoc)
       this._persistSession?.('update', this.session)
       return res
diff --git a/packages/api/src/types.ts b/packages/api/src/types.ts
index a633ff79a33..f6acbb64db7 100644
--- a/packages/api/src/types.ts
+++ b/packages/api/src/types.ts
@@ -26,6 +26,7 @@ export interface AtpSessionData {
   did: string
   email?: string
   emailConfirmed?: boolean
+  emailAuthFactor?: boolean
 }
 
 /**
@@ -50,6 +51,7 @@ export interface AtpAgentOpts {
 export interface AtpAgentLoginOpts {
   identifier: string
   password: string
+  authFactorToken?: string | undefined
 }
 
 /**