---
title: "Start TOTP enrollment"
method: POST
path: "/user/start/setup-two-factor"
tags: ["Enrollment"]
---

# Start TOTP enrollment

`POST /user/start/setup-two-factor`

Returns a TOTP secret and an otpauth:// provisioning URI. Render the URI as a QR code (or expose the base32 secret) so the user can add the entry to their authenticator app, then call `/user/resume/setup-two-factor` with the first 6-digit code. — Requires `'totp'` to be present in the application's `allowedScaMethods`.

## Request body

- object
  - `userId` string, required

## Response `200`

TOTP secret and provisioning URI.

- object
  - `secret` string — Raw TOTP secret.
  - `secretBase32Encoded` string — Base32-encoded TOTP secret for authenticator apps.
  - `totpUri` string — otpauth://totp/... URI; encode as a QR code on the client.

## Other responses

- `400` — Request was rejected. The `errorCode` field disambiguates.
- `401` — Invalid API key or HMAC signature.

---

[API](https://skmtc.net/striga/apis/striga-v1.md) · [All operations](https://skmtc.net/striga/apis/striga-v1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/striga/striga-v1/versions/63e57aa7df45/schema)