---
title: "Enables TOTP 2FA on the caller's account."
method: POST
path: "/api/v1/core/me/mfa/enable"
tags: ["Core/Me"]
---

# Enables TOTP 2FA on the caller's account.

`POST /api/v1/core/me/mfa/enable`

Validates the first TOTP from the authenticator app, turns 2FA on, and
returns 10 single-use recovery codes. Show the codes to the user once —
the platform only stores their hashes. Lose them and call
`/me/mfa/recovery-codes`.

## Request body

- MfaCodeRequest — Body for `POST /me/mfa/enable` and `/disable` — the TOTP the user just typed.
  - `code` string, nullable

## Response `200`

2FA enabled, recovery codes returned

- ApiResponseMfaRecoveryCodesResponse — Standard API response envelope. All API endpoints return this structure. `data`: the payload (object or collection). `pagination`: present only for paginated collections.
  - `data` MfaRecoveryCodesResponse — Recovery codes returned after a successful `POST /me/mfa/enable` or a `POST /me/mfa/recovery-codes` regeneration. The user must store them — the platform doesn't keep a plaintext copy past this response.
    - `codes` string[], nullable — 10 single-use codes formatted as 11-char strings.
  - `pagination` PaginationMeta — Pagination metadata included in paginated API responses.
    - `page` integer
    - `pageSize` integer
    - `totalCount` integer
    - `totalPages` integer

## Other responses

- `400` — Invalid or expired TOTP
- `401` — Not authenticated

---

[API](https://skmtc.net/neotimo/apis/neotimo-api.md) · [All operations](https://skmtc.net/neotimo/apis/neotimo-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/neotimo/neotimo-api/revisions/2ecf51b1543e/schema)