Auth
Begin MFA Setup
Generate a pending TOTP secret and the otpauth URI for enrolling an authenticator app.
POST
Begin TOTP MFA setup
Generates a TOTP secret for the logged-in user and returns the
otpauth://
URI (render it as a QR code) plus the raw secret (for manual entry). MFA is
not enabled until a code from the authenticator is confirmed with
Verify MFA. Calling setup again before
verifying replaces the pending secret. Once MFA is enabled, logins require a
second step via Complete an MFA Login, and it
can be switched off with Disable MFA.
Requires a logged-in user session; API-key callers receive 401.
Example Request
Example Response
Fields
Errors
Errors use the standard envelope — see Errors.
Authorizations
Dashboard user session cookie (httpOnly) issued by POST /auth/register and POST /auth/login. v1 endpoints accept EITHER this cookie or the tenant API key (bearerAuth).