---
title: "Generate TOTP secret"
method: GET
path: "/mfa/totp/generate"
tags: ["user"]
---

# Generate TOTP secret

`GET /mfa/totp/generate`

Generate a Time-based One-Time Password (TOTP) secret for setting up multi-factor authentication

## Response `200`

TOTP secret successfully generated

- TotpGenerateResponse — Response containing TOTP setup information for MFA
  - `imageUrl` string, required — URL to QR code image for scanning with an authenticator app
  - `totpSecret` string, required — TOTP secret key for manual setup with an authenticator app

## Other responses

- `default` — An error occurred while processing the request

## Changes

- **2026-06-24** `50e844d0b840` — 2 info
  - the endpoint scheme security `BearerAuthElevated` was added to the API
  - the endpoint scheme security `BearerAuth` was removed from the API
- **2026-06-24** `0fc5fd589dbf` — 1 warning
  - added the new `otp-too-many-attempts` enum value to the `error` response property for the response status `default`
- **2026-04-20** `b39086c84b43` — 1 warning, 1 info
  - added the new `user-already-exists` enum value to the `error` response property for the response status `default`
  - removed the `email-already-in-use` enum value from the `error` response property for the response status `default`
- **2025-11-11** `484d9f1a422a` — 1 warning
  - added the new `provider-account-already-linked` enum value to the `error` response property for the response status `default`
- **2025-10-09** `2bb5c4e40463` — 1 warning, 5 info
  - added the new `email-already-in-use` enum value to the `error` response property for the response status `default`
  - the endpoint scheme security `BearerAuth` was added to the API
  - the endpoint scheme security `BearerAuthElevated` was removed from the API
  - removed the `otp-too-many-attempts` enum value from the `error` response property for the response status `default`
  - …2 more

[Change history](https://skmtc.dev/nhost/apis/nhost-authentication-api/changes/mfa/totp/generate/get.md)

---

[API](https://skmtc.dev/nhost/apis/nhost-authentication-api.md) · [All operations](https://skmtc.dev/nhost/apis/nhost-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/nhost/nhost-authentication-api/revisions/a5c0d88b55c4/schema)