Authentication

Mfa Setup

Begin TOTP enrollment.

Generates a fresh secret, stores it as totp_pending_secret (encrypted), and returns the otpauth:// provisioning URI. The frontend renders the QR code from that URI. The secret is not promoted to active until the user confirms a code via /mfa/confirm.

Two callers:

  • Authenticated user opting in from Profile (current_user via cookie)
  • Org-enforcement-blocked user finishing first-time enrollment (mfa_token from URL fragment after SSO / password gate)

Idempotent: re-calling replaces any prior pending secret. Rejected if MFA is already enabled — the user must disable first.

post/api/auth/mfa/setup

Request

  • Base URL: https://app.getdot.ai (the document declares no server; this is the origin it was published from)
  • URL: https://app.getdot.ai/api/auth/mfa/setup
  • Auth: one of:
    • API key in header X-API-KEY
    • API key in cookie Authorization
    • OAuth 2 (password, token URL /api/auth/token)

Request body

mfa_tokenstring nullable

Response

Successful Response

unknown required

Changes

No recorded changes to this operation across all 1 revision of this API.