---
title: "Totp Setup"
method: POST
path: "/auth/totp/setup"
tags: ["auth-totp", "auth-totp"]
---

# Totp Setup

`POST /auth/totp/setup`

## Request

- Base URL: `https://api.dialogbrain.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.dialogbrain.com/auth/totp/setup`
- Auth: none declared

Mint a fresh unconfirmed secret and return the QR payload.

The secret lands in `totp_pending_secret_encrypted`, never on the live
one. That is what makes "move to a new phone" safe: the authenticator the
user still carries keeps working until a code from the NEW app promotes
it, and a setup that is started and abandoned changes nothing at all.

## Response `200`

Successful Response

- SetupResponse
  - `secret` string, required
  - `otpauth_uri` string, required

---

[API](https://skmtc.dev/dialogbrain/apis/dialogbrain-v2-api-gateway.md) · [All operations](https://skmtc.dev/dialogbrain/apis/dialogbrain-v2-api-gateway/llms.txt) · [OpenAPI document](https://skmtc.dev/dialogbrain/apis/dialogbrain-v2-api-gateway/revisions/d84e7dc9977d?raw)