Skip to main content

Begin TOTP enrolment

POST 
/admin/auth/totp/enroll

Returns the shared secret and its otpauth:// URI — a QR code's worth of data, not an image. The client renders the code from this string.

Two-factor stays off until it is activated. Enabling it here would lock out anyone who scanned the code into an authenticator that does not work.

Re-enrolling while two-factor is already on is refused: it would replace a working secret in one request, so resetting an authenticator has to go through disabling first, which costs a password.

Responses​

Pairing material — not active yet