---
title: "Enable two-factor authentication"
method: POST
path: "/account/two-factor/enable"
tags: ["Admin Authentication"]
---

# Enable two-factor authentication

`POST /account/two-factor/enable`

## Request

- Base URL: `http://localhost:8000/api/admin`
- URL: `http://localhost:8000/api/admin/account/two-factor/enable`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/bagisto/apis/bagisto-admin-api/docs/account/two-factor/enable/post.ts> (a function with typed inputs; its response is checked against the schema)

Verifies a six-digit code from the authenticator app against the setup secret and turns two-factor authentication on. Returns eight one-time backup codes, shown only here and emailed to the admin.

## Request body

- object
  - `code` string, required

## Response `200`

Enabled.

## Other responses

- `400`: Invalid input
- `401`: Missing or invalid admin token.
- `422`: Invalid code, or setup was not run first.

## Changes

- **2026-10-28** `3198f11be70f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/bagisto/apis/bagisto-admin-api/changes/account/two-factor/enable/post.md)

---

[API](https://skmtc.dev/bagisto/apis/bagisto-admin-api.md) - [All operations](https://skmtc.dev/bagisto/apis/bagisto-admin-api/llms.txt) - [OpenAPI document](https://skmtc.dev/bagisto/apis/bagisto-admin-api/revisions/3198f11be70f?raw)