Start two-factor authentication enrollment

Re-verifies the caller's password (a stolen session cookie alone must not be able to enroll 2FA and lock the owner out), then generates a fresh TOTP secret and stores it as pending — login ignores it until POST /auth/totp/confirm proves the authenticator holds it. Refused with 400 if two-factor authentication is already enabled. Shares the per-user 5 code attempts per minute limiter with confirm and login phase 2.

post/auth/totp/setup

Request

  • Base URL: https://app.yoping.me/api/v1
  • URL: https://app.yoping.me/api/v1/auth/totp/setup
  • Auth: API key in cookie yp_session

Request body

passwordstring required

The caller's current password, re-verified before starting enrollment so a stolen session cookie alone cannot enable two-factor authentication.

Response

Pending secret created.

Changes

No recorded changes to this operation across all 1 revision of this API.