---
title: "Complete TOTP enrollment"
method: POST
path: "/user/resume/setup-two-factor"
tags: ["Enrollment"]
---

# Complete TOTP enrollment

`POST /user/resume/setup-two-factor`

Confirms the secret returned by `/user/start/setup-two-factor` by submitting the current 6-digit code from the authenticator app. Returns the one-time recovery codes — show them to the user once.

## Request body

- object
  - `userId` string, required
  - `secret` string, required — Secret returned by `/user/start/setup-two-factor`.
  - `code` string, required

## Response `200`

TOTP is now enrolled. Recovery codes returned once.

- object
  - `recoveryCodes` string[] — One-time recovery codes.

## Other responses

- `400` — Request was rejected. The `errorCode` field disambiguates.
- `401` — Invalid API key or HMAC signature.

---

[API](https://skmtc.net/striga/apis/striga-v1.md) · [All operations](https://skmtc.net/striga/apis/striga-v1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/striga/striga-v1/revisions/63e57aa7df45/schema)