Skip to main content

Get TOTP Setup Details

GET 
/api/auth/2fa/totp/setup

Get a TOTP secret, recovery codes and a TOTP URL. This is the first step to enabling TOTP as 2FA method. You can learn more about this here.

The user needs to save the recovery codes and use the URL or the secret to set up 2FA in their 2FA app.

This secret will be stored inside the token contained in the response. This token is required to enable TOTP. Performing this request will not change the user's state in the database. Therefore, the token is the single point of truth for validation. Every request will generate a new TOTP secret, new recovery codes and a new TOTP URL.

The setup can be completed through the endpoint POST /api/auth/2fa/totp/setup using the token and a 2FA code from an authenticator app.

Requirements​

  • The user can authenticate using password. 2FA will not work with OAuth2. The OAuth2 provider will validate the second factor if the user enabled it for the provider.

Tokens​

  • A valid AccessToken is required.
  • A valid StepUpToken is required. This token should match user and session contained in the AccessToken.

Responses​

The TOTP secret, recovery codes, TOTP URL and setup token.