---
title: "Returns the TOTP 2FA enrollment payload."
method: GET
path: "/api/v1/core/me/mfa/setup"
tags: ["Core/Me"]
---

# Returns the TOTP 2FA enrollment payload.

`GET /api/v1/core/me/mfa/setup`

The bits an authenticator app needs to enroll the caller: shared key plus
an `otpauth://` URI to feed a QR generator. When 2FA is already on,
only the `IsEnabled` flag comes back — no leaking the secret twice.

## Response `200`

Setup payload returned

- ApiResponseMfaSetupResponse — Standard API response envelope. All API endpoints return this structure. `data`: the payload (object or collection). `pagination`: present only for paginated collections.
  - `data` MfaSetupResponse — Carries the data the profile UI needs to walk the user through enabling an authenticator-app TOTP. Returned by `GET /me/mfa/setup`.
    - `isEnabled` boolean — Whether 2FA is already active on the account.
    - `sharedKey` string, nullable — Human-typeable form of the TOTP secret (4-char groups, lowercase). Shown to the user as a fallback when their authenticator app can't scan the QR code.
    - `otpAuthUri` string, nullable — Standard `otpauth://totp/...` URI — fed straight into a QR generator (TelerikQRCode component) or invoked as a deep link on mobile.
  - `pagination` PaginationMeta — Pagination metadata included in paginated API responses.
    - `page` integer
    - `pageSize` integer
    - `totalCount` integer
    - `totalPages` integer

## Other responses

- `401` — Not authenticated

---

[API](https://skmtc.net/neotimo/apis/neotimo-api.md) · [All operations](https://skmtc.net/neotimo/apis/neotimo-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/neotimo/neotimo-api/revisions/2ecf51b1543e/schema)