---
title: "Start TOTP enrollment"
method: POST
path: "/user/start/setup-two-factor"
tags: ["Enrollment"]
---

# Start TOTP enrollment

`POST /user/start/setup-two-factor`

## Request

- Base URL: `https://www.sandbox.striga.com/api/v1`
- URL: `https://www.sandbox.striga.com/api/v1/user/start/setup-two-factor`
- Auth: API key in header `api-key` and API key in header `Authorization`

Returns a TOTP secret and an otpauth:// provisioning URI. Render the URI as a QR code (or expose the base32 secret) so the user can add the entry to their authenticator app, then call `/user/resume/setup-two-factor` with the first 6-digit code. — Requires `'totp'` to be present in the application's `allowedScaMethods`. — Requires an active SCA session granted within the last 15 minutes, else `30070` (`SCA_REQUIRED`) with `reason` `NO_SESSION` or `EXPIRED`, exactly as the SCA-gated reads report it; run `/user/login/start` + `/user/login/complete` and retry inside the window. An open 2FA reset for this factor whose `/complete` call has already removed the old factor authorizes the call as well, and users without an SCA-gated (EUR/USDC) account yet are exempt.

## Request body

- object
  - `userId` string, required

## Response `200`

TOTP secret and provisioning URI.

- object
  - `secret` string: Raw TOTP secret.
  - `secretBase32Encoded` string: Base32-encoded TOTP secret for authenticator apps.
  - `totpUri` string: otpauth://totp/... URI; encode as a QR code on the client.

## Other responses

- `400`: Request was rejected. The `errorCode` field disambiguates.
- `401`: Invalid API key or HMAC signature.

---

[API](https://skmtc.dev/striga/apis/striga-strong-customer-authentication.md) - [All operations](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/llms.txt) - [OpenAPI document](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/revisions/6a0cf1c67072?raw)