diff --git a/.changeset/two-factor-view-backup-codes-jsdoc.md b/.changeset/two-factor-view-backup-codes-jsdoc.md
new file mode 100644
index 0000000000..515f50c337
--- /dev/null
+++ b/.changeset/two-factor-view-backup-codes-jsdoc.md
@@ -0,0 +1,7 @@
+---
+"better-auth": patch
+---
+
+Document `viewBackupCodes` as a server-only function so its API comment no longer reads like an HTTP route.
+
+The JSDoc above `auth.api.viewBackupCodes` advertised `POST /two-factor/view-backup-codes`, but the endpoint is server-only: it is not registered on the HTTP router and has no client method. The comment now states that it is callable only from trusted server code and that the `userId` should come from an authenticated session.
diff --git a/packages/better-auth/src/plugins/two-factor/backup-codes/index.ts b/packages/better-auth/src/plugins/two-factor/backup-codes/index.ts
index 85944ff4f1..d4ca1eacb2 100644
--- a/packages/better-auth/src/plugins/two-factor/backup-codes/index.ts
+++ b/packages/better-auth/src/plugins/two-factor/backup-codes/index.ts
@@ -507,9 +507,10 @@ export const backupCode2fa = (opts: BackupCodeOptions) => {
 				},
 			),
 			/**
-			 * ### Endpoint
-			 *
-			 * POST `/two-factor/view-backup-codes`
+			 * A server-only function that returns a user's decrypted two-factor
+			 * backup codes. It is not exposed over HTTP and has no client method;
+			 * call it from trusted server code with a `userId` taken from an
+			 * authenticated session.
 			 *
 			 * ### API Methods
 			 *