Skip to main content
POST
cURL

Query Parameters

data
unknown
required

Response

The shared secret and enrollment-test challenge are returned.

Returned from POST /api/v1/tokens/two-factor/enroll/totp/begin when a user forced into 2FA chooses to enroll an authenticator app. Carries the shared secret in the three forms a client may need to present it, plus the challenge token the user's first generated code is confirmed against. The property names are snake_case to match the wire format of the other token endpoints (see TokenPayload).

challenge_token
string | null

Short-lived signed JWT identifying the enrollment-test challenge. Echo it back to POST /api/v1/tokens/two-factor/enroll/totp/confirm along with the first code from the authenticator app.

secret
string | null

The Base32-encoded shared secret. Offer this for manual entry by users who cannot scan the QR code.

otpauth_uri
string | null

The full otpauth://totp/... URI encoding the secret, issuer and parameters. Most authenticator apps add an account directly from this.

qr_code_png_base64
string | null

A QR code rendering of otpauth_uri as a PNG, Base64 encoded — render it as an [Image blocked: No description] for the user to scan.

expires_in
integer<int32>

Seconds until the enrollment-test challenge expires (600).