Begin multi-factor authentication setup
POST/api/auth/mfa/setup
Generates a TOTP secret, a QR code, and 10 single-use backup codes for the authenticated user. The secret is stored encrypted and the backup codes are stored hashed. MFA is not enabled until the user confirms a code via POST /api/auth/mfa/enable. The plaintext secret and backup codes are returned once and should not be requested again; calling setup a second time replaces the pending secret and codes.
Responses
- 200
- 401
- 500
MFA setup initiated
Not authenticated
Server error