---
title: "Begin enrolling a new factor for MFA."
method: POST
path: "/factors"
tags: ["user"]
---

# Begin enrolling a new factor for MFA.

`POST /factors`

## Request body

- object
  - `factor_type` 'totp' | 'phone' | 'webauthn', required
  - `friendly_name` string
  - `issuer` string, uri
  - `phone` string, phone

## Response `200`

A new factor was created in the unverified state. Call `POST /factors/{factorId}/verify' to verify it.

- object
  - `id` string
  - `type` 'totp' | 'phone' | 'webauthn'
  - `totp` object
    - `qr_code` string
    - `secret` string
    - `uri` string
  - `phone` string, phone

## Other responses

- `400` — HTTP Bad Request response. Can occur if the passed in JSON cannot be unmarshalled properly or when CAPTCHA verification was not successful. In certain cases can also occur when features are disabled on the server (e.g. sign ups). It may also mean that the operation failed due to some constraint not being met (such a user already exists for example).

## Changes

- **2025-02-07** `4d0f1a6c1ad9` — 1 info
  - added the optional property `error_code` to the response with the `400` status
- **2024-10-11** `f89bf040698f` — 1 warning, 1 info
  - added the new `webauthn` enum value to the `type` response property for the response status `200`
  - added the new `webauthn` enum value to the request property `factor_type`
- **2024-08-01** `b33a9ea8493e` — 1 warning, 3 info
  - added the new `phone` enum value to the `type` response property for the response status `200`
  - added the new optional request property `phone`
  - added the new `phone` enum value to the request property `factor_type`
  - added the optional property `phone` to the response with the `200` status
- **2023-12-13** `77f9aeb9339a` — 1 info
  - added the optional property `weak_password` to the response with the `400` status
- **2023-02-01** `144a34ca6d74` — 2 breaking, 4 warning, 2 info
  - removed the enum value `phone` of the request property `factor_type`
  - removed the enum value `webauthn` of the request property `factor_type`
  - removed the request property `phone`
  - removed the optional property `error_code` from the response with the `400` status
  - …4 more

[Change history](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/changes/factors/post.md)

---

[API](https://skmtc.dev/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/revisions/2e2a74a7459f/schema)