---
title: "POST /api/v1/tokens/two-factor/enroll/totp/begin"
method: POST
path: "/api/v1/tokens/two-factor/enroll/totp/begin"
tags: ["Public"]
---

# POST /api/v1/tokens/two-factor/enroll/totp/begin

`POST /api/v1/tokens/two-factor/enroll/totp/begin`

## Request

- Base URL: `https://go.outseta.com`
- URL: `https://go.outseta.com/api/v1/tokens/two-factor/enroll/totp/begin`
- Auth: none declared

## Query parameters

- `data` unknown, required

## Response `200`

The shared secret and enrollment-test challenge are returned.

- TwoFactorTotpEnrollmentPayload: Returned from POST /api/v1/tokens/two-factor/enroll/totp/begin when a user forced into 2FA chooses to enroll an authenticator app. Carries the shared secret in the three forms a client may need to present it, plus the challenge token the user's first generated code is confirmed against. The property names are snake_case to match the wire format of the other token endpoints (see TokenPayload).
  - `challenge_token` string, nullable: Short-lived signed JWT identifying the enrollment-test challenge. Echo it back to POST /api/v1/tokens/two-factor/enroll/totp/confirm along with the first code from the authenticator app.
  - `secret` string, nullable: The Base32-encoded shared secret. Offer this for manual entry by users who cannot scan the QR code.
  - `otpauth_uri` string, nullable: The full otpauth://totp/... URI encoding the secret, issuer and parameters. Most authenticator apps add an account directly from this.
  - `qr_code_png_base64` string, nullable: A QR code rendering of otpauth_uri as a PNG, Base64 encoded — render it as an <img> for the user to scan.
  - `expires_in` integer: Seconds until the enrollment-test challenge expires (600).

## Other responses

- `401`: The enrollment token is missing, invalid or expired.
- `403`: Forced 2FA enrollment does not apply to this user.

---

[API](https://skmtc.dev/outseta/apis/outseta-api.md) · [All operations](https://skmtc.dev/outseta/apis/outseta-api/llms.txt) · [OpenAPI document](https://skmtc.dev/outseta/apis/outseta-api/revisions/c362823af82d?raw)