---
title: "Setup 2Fa"
method: POST
path: "/api/v1/security/2fa/setup"
tags: ["Security"]
---

# Setup 2Fa

`POST /api/v1/security/2fa/setup`

## Request

- Base URL: `https://app.aimrank.io` (the document declares no server; this is the origin it was published from)
- URL: `https://app.aimrank.io/api/v1/security/2fa/setup`
- Auth: none declared

Generate a TOTP secret and QR code. Does NOT enable 2FA yet — call /verify next.

Switched off: login does not yet enforce a second factor (see module
docstring), so enrolling would promise protection that does not exist.

## Response `200`

Successful Response

- Setup2FAResponse
  - `secret` string, required
  - `qr_code_data_url` string, required
  - `manual_entry_key` string, required

---

[API](https://skmtc.dev/aimrank/apis/aimrank-api.md) · [All operations](https://skmtc.dev/aimrank/apis/aimrank-api/llms.txt) · [OpenAPI document](https://skmtc.dev/aimrank/apis/aimrank-api/revisions/3574d0aff459?raw)