---
title: "POST /api/v1/settings/mfa/setup"
method: POST
path: "/api/v1/settings/mfa/setup"
tags: ["Security"]
---

# POST /api/v1/settings/mfa/setup

`POST /api/v1/settings/mfa/setup`

## Request

- Base URL: `https://app.distr.sh` (the document declares no server; this is the origin it was published from)
- URL: `https://app.distr.sh/api/v1/settings/mfa/setup`
- Auth: one of:
  - API key in header `Authorization`
  - HTTP bearer

Setup a new TOTP secret for the current user. MFA must still be enabled afterwards

## Response `200`

OK

- ApiSetupMFAResponse
  - `qrCodeUrl` string
  - `secret` string

---

[API](https://skmtc.dev/distr/apis/distr-api-reference.md) - [All operations](https://skmtc.dev/distr/apis/distr-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/distr/apis/distr-api-reference/revisions/7dcafe205f83?raw)