Returns a fresh TOTP shared secret for enrolling a user in two-factor authentication. Call this once, during initial MFA setup for a user, then register the returned secretBase32Encoded value with POST /mfa/enable. Store it securely: the same secret is required to generate the TOTP code for every subsequent login, and this endpoint returns a different secret on every call. Calling it does not enrol anything or change the user.
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Missing required request parameters: [Authorization]. Returned by the gateway request validator when the Authorization header is absent, before the request reaches the identity provider.
Invalid Authorization Header. Returned when the header is present but is not a valid API key, including when a Bearer JWT is sent instead of the raw key.