Set up TOTP

Session-only. Begin two-factor enrollment. Returns the base32 secret, an otpauth:// URI, and a QR data URL to scan. Enforcement does not start until POST /me/totp/enable confirms a live code.

POST /me/totp/setup

Set up TOTP

cURL

curl --request POST \
  --url https://aropay.aro.media/api/v1/me/totp/setup \
  --cookie aropay_session=

200

{
  "ok": "<unknown>",
  "data": {
    "secret": "<string>",
    "otpauthUri": "<string>",
    "qrDataUrl": "<string>"
  }
}

Authorizations

aropay_session · string · cookie · required

Browser session cookie minted by POST /auth/login (or passkey login). httpOnly, SameSite=Lax, 24 h TTL. Endpoints marked Session-only accept only this credential and return 403 session_required for API keys.

Response

200

application/json

Enrollment material.

ok · any · required

data · object · required

Show child attributes