Skip to main content
POST
Begin TOTP MFA setup
Generates a TOTP secret for the logged-in user and returns the otpauth:// URI (render it as a QR code) plus the raw secret (for manual entry). MFA is not enabled until a code from the authenticator is confirmed with Verify MFA. Calling setup again before verifying replaces the pending secret. Once MFA is enabled, logins require a second step via Complete an MFA Login, and it can be switched off with Disable MFA. Requires a logged-in user session; API-key callers receive 401.

Example Request

Example Response

Fields

Errors

Errors use the standard envelope — see Errors.

Authorizations

recurso_session
string
cookie
required

Dashboard user session cookie (httpOnly) issued by POST /auth/register and POST /auth/login. v1 endpoints accept EITHER this cookie or the tenant API key (bearerAuth).

Response

Provisioning data for the authenticator app.

secret
string
otpauth_url
string