---
title: "Begin TOTP enrolment"
method: POST
path: "/v1/auth/2fa/setup"
tags: ["Auth"]
---

# Begin TOTP enrolment

`POST /v1/auth/2fa/setup`

## Request

- Base URL: `https://api.briefgate.dev`
- URL: `https://api.briefgate.dev/v1/auth/2fa/setup`
- Auth: HTTP bearer

Mints a secret and returns it once, as an otpauth:// URI for an authenticator app. The factor is NOT enabled here — /enable is, once a code from the secret verifies, so an abandoned or mistyped enrolment cannot lock the account out.

## Response `200`

Secret issued

- object
  - `secret` string: Base32, shown once.
  - `otpauth_uri` string
  - `next` string

## Other responses

- `400`: Vault keys are not configured
- `401`: Missing or invalid API key
- `409`: Already enabled

---

[API](https://skmtc.dev/briefgate/apis/briefgate-api.md) · [All operations](https://skmtc.dev/briefgate/apis/briefgate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/briefgate/apis/briefgate-api/revisions/b21afed4748b?raw)