POST
Start 2FA setup
For a user who is already signed in and wants to add 2FA to their account. (During first-time registration, use security setup instead — same idea, but driven by a session_token rather than a bearer token.) The first of two steps. You get back a secret and a qr_uri. Show the QR code so the user can add it to their authenticator app, then confirm the setup with the first code the app shows. This call needs the user’s bearer token.

Authorizations

Authorization
string
header
required

The user's id_token from authentication — the ID token, not the access_token. The program and environment come from the token.

Headers

x-program-id
string
required

Identifies the program. Can also be sent as the programId query parameter.

Response

Setup details

success
boolean
Example:

true

data
object