MFAStart MFA enrollment

Start MFA enrollment

Generates a TOTP secret, persists it encrypted with mfa_enabled still false, and returns otpauth_url plus Base32 secret for manual entry. The SPA should render a QR code from otpauth_url locally. 409 if MFA is already fully enabled.

curl -X POST "//api/auth/mfa/enroll/begin" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN (JWT or sb_ API token)"
{
  "otpauth_url": "example_string",
  "secret": "example_string"
}
POST
/api/auth/mfa/enroll/begin
POST
Bearer Token (JWT or sb_ API token)
Bearer Tokenstring
Required

Use Authorization: Bearer <token>. Personal API tokens from Profile use the sb_ prefix. You may also send the access JWT as Bearer (same value as the token cookie after login).

Use Authorization: Bearer <token>. Personal API tokens from Profile use the sb_ prefix. You may also send the access JWT as Bearer (same value as the token cookie after login).
Request Preview
Response

Response will appear here after sending the request

Authentication

header
Authorizationstring
Required

Bearer token (JWT or sb_ API token). Use Authorization: Bearer \<token\>. Personal API tokens from Profile use the sb_ prefix. You may also send the access JWT as Bearer (same value as the token cookie after login).

Responses

otpauth_urlstring
Required

otpauth URI for QR / authenticator import (do not log in production)

secretstring
Required

Base32 secret for manual entry