Totp Setup

POST

/auth/totp/setup

const url = 'https://example.com/auth/totp/setup';
const options = {method: 'POST'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://example.com/auth/totp/setup

Begin enrollment: mint a secret (encrypted at rest) and return it + the otpauth:// URI. Re-running before enable simply rotates the unverified secret; 409 once 2FA is live (disable first — prevents silently swapping the authenticator without a code).

Responses

200

Successful Response

application/json

TotpSetupResponse

object

otpauth_uri

required

Otpauth Uri

string

secret

required

Secret

string

Example^generated

{
  "otpauth_uri": "example",
  "secret": "example"
}

Totp Setup

Responses

200

Examplegenerated

Example^generated