Starts setting up an authenticator app.
Nothing changes at sign-in yet. The account is asked for a code only once
POST /account/mfa/totp/confirm has seen one, so a QR code scanned wrong
cannot lock anybody out. Calling this again replaces a secret that was
never confirmed.
Why it asks for the password
Turning the second step on is a way to lock the owner out: a borrowed, unlocked browser could set it up with the borrower's phone.
Errors
401 when the password is wrong, 403 when a bearer token was used, 409
when two-step sign-in is already on.
sessiontessera_session<token>Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.
application/json- body
Body of POST /account/mfa/totp.
current_password?|The current password. Omitted by an account without one, which confirms by a recent sign-in instead.
8 <= length <= 1024The secret to put in the app
application/json- response
What POST /account/mfa/totp answers: the secret to put in the app.
secret*stringThe secret, for typing into an app that cannot scan.
uri*stringThe otpauth:// link, for a client to draw as a QR code.
curl -X POST 'https://example.com/api/v1/account/mfa/totp' \ -H 'Content-Type: application/json' \ -d '{}'{ "secret": "string", "uri": "string"}