---
title: "Two-factor setup"
method: GET
path: "/account/two-factor"
tags: ["Admin Authentication"]
---

# Two-factor setup

`GET /account/two-factor`

## Request

- Base URL: `http://localhost:8000/api/admin`
- URL: `http://localhost:8000/api/admin/account/two-factor`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/bagisto/apis/bagisto-admin-api/docs/account/two-factor/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns the QR code (SVG and otpauth URL) to scan into an authenticator app. The secret is generated on the first call and reused until two-factor authentication is disabled. Refused once two-factor authentication is enabled.

## Response `200`

Setup data.

## Other responses

- `401`: Missing or invalid admin token.
- `422`: Two-factor authentication is already enabled.

## Changes

- **2026-10-28** `3198f11be70f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/bagisto/apis/bagisto-admin-api/changes/account/two-factor/get.md)

---

[API](https://skmtc.dev/bagisto/apis/bagisto-admin-api.md) - [All operations](https://skmtc.dev/bagisto/apis/bagisto-admin-api/llms.txt) - [OpenAPI document](https://skmtc.dev/bagisto/apis/bagisto-admin-api/revisions/3198f11be70f?raw)