---
title: "Mfa Setup"
method: POST
path: "/api/auth/mfa/setup"
tags: ["Authentication"]
---

# Mfa Setup

`POST /api/auth/mfa/setup`

## Request

- Base URL: `https://app.getdot.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://app.getdot.ai/api/auth/mfa/setup`
- Auth: one of:
  - API key in header `X-API-KEY`
  - API key in cookie `Authorization`
  - OAuth 2 (password, token URL `/api/auth/token`)

Begin TOTP enrollment.

Generates a fresh secret, stores it as `totp_pending_secret` (encrypted),
and returns the otpauth:// provisioning URI. The frontend renders the QR
code from that URI. The secret is not promoted to active until the user
confirms a code via /mfa/confirm.

Two callers:
  - Authenticated user opting in from Profile (current_user via cookie)
  - Org-enforcement-blocked user finishing first-time enrollment
    (mfa_token from URL fragment after SSO / password gate)

Idempotent: re-calling replaces any prior pending secret. Rejected if MFA
is already enabled — the user must disable first.

## Request body

- BodyMfaSetupApiAuthMfaSetupPost
  - `mfa_token` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/getdot/apis/dot-api-2.md) · [All operations](https://skmtc.dev/getdot/apis/dot-api-2/llms.txt) · [OpenAPI document](https://skmtc.dev/getdot/apis/dot-api-2/revisions/d26fe7163a7f?raw)