---
title: "Enroll Totp"
method: POST
path: "/auth/mfa/enroll/totp"
tags: ["Auth"]
---

# Enroll Totp

`POST /auth/mfa/enroll/totp`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/auth/mfa/enroll/totp`
- Auth: HTTP bearer

Start a TOTP enrolment.

Generates a fresh secret, stores a pending (`is_active=False`) row,
and returns the otpauth:// URI + the manual base32 secret so the
user can either scan the QR or paste it into their authenticator.

Recovery-locked sessions (``mfa_recovery=true``) are deliberately
allowed here — that's how a user clears their recovery lock.

## Headers

- `API-Version` '1'

## Request body

- TotpEnrolRequest: POST body for /auth/mfa/enroll/totp. ``label`` is a free-text user-chosen string surfaced in the methods list so they can tell their devices apart (e.g. "Authy on iPhone").
  - `label` string, required

## Response `200`

Successful Response

- TotpEnrolResponse: Body returned by /auth/mfa/enroll/totp. The plaintext secret is returned exactly once so the user can either scan the QR (rendered client-side from ``otpauth_uri``) or type the code manually into apps that don't scan QRs.
  - `method_id` integer, required
  - `otpauth_uri` string, required
  - `manual_secret` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/totalparks/apis/total-parks-public-api.md) · [All operations](https://skmtc.dev/totalparks/apis/total-parks-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/totalparks/apis/total-parks-public-api/revisions/dcb4c822e2c6?raw)