---
title: "Create TOTP secret"
method: POST
path: "/api/experience/verification/totp/secret"
tags: ["Experience"]
---

# Create TOTP secret

`POST /api/experience/verification/totp/secret`

Create a new TOTP verification record and generate a new TOTP secret for the user. This secret can be used to bind a new TOTP verification to the user's profile. The verification record must be verified before the secret can be used to bind a new TOTP verification to the user's profile.

## Response `200`

TOTP secret successfully generated.

- object
  - `verificationId` string, required — The unique verification ID for the TOTP record. This ID is required to verify the TOTP code.
  - `secret` string, required — The newly generated TOTP secret.
  - `secretQrCode` string, required — A QR code image data URL for the TOTP secret. The user can scan this QR code with their TOTP authenticator app.

## Other responses

- `400` — Bad Request
- `404` — Entity not found. <br/> - `session.identifier_not_found:` The current interaction is not identified yet. All MFA verification records must be associated with a identified user.

---

[API](https://skmtc.net/logto/apis/logto-api-references.md) · [All operations](https://skmtc.net/logto/apis/logto-api-references/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/logto/logto-api-references/revisions/0287c6a59eba/schema)