Setup TOTP Device

POST/auth/mfa/setup-totp

Request body

NestAuthSetupTotpRequestDto

Field	Type	Required	Description
`label`	`string`	optional	Account label shown in the authenticator app (under the issuer). Defaults to the user's email. Use it to disambiguate multiple accounts of the same person — e.g. `"ada@acme.com (Acme Corp)"` in a multi-tenant app. Example: `ada@acme.com (Acme Corp)`
`deviceName`	`string`	optional	Human-readable name stored for this authenticator device (not shown in the app). Defaults to `{appName} : {email}`. Example: `iPhone Authenticator`

Examples

Example

{
  "label": "ada@acme.com (Acme Corp)",
  "deviceName": "iPhone Authenticator"
}

Responses

200

400Invalid or expired code.

ApiErrorResponseDto

Field	Type	Required	Description
`statusCode`	`number`	required	HTTP status code Example: `401`
`error`	`string`	required	HTTP status text / exception name Example: `Unauthorized`
`message`	`string`	required	Human-readable message Example: `Invalid credentials`
`code`	`string`	required	Stable, machine-readable error code — branch on this, not the message Example: `INVALID_CREDENTIALS`

Example response

{
  "statusCode": 401,
  "error": "Unauthorized",
  "message": "Invalid credentials",
  "code": "INVALID_CREDENTIALS"
}

401Missing, invalid, or expired authentication.

ApiErrorResponseDto

Field	Type	Required	Description
`statusCode`	`number`	required	HTTP status code Example: `401`
`error`	`string`	required	HTTP status text / exception name Example: `Unauthorized`
`message`	`string`	required	Human-readable message Example: `Invalid credentials`
`code`	`string`	required	Stable, machine-readable error code — branch on this, not the message Example: `INVALID_CREDENTIALS`

Example response

{
  "statusCode": 401,
  "error": "Unauthorized",
  "message": "Invalid credentials",
  "code": "INVALID_CREDENTIALS"
}

403Authenticated but not permitted.

ApiErrorResponseDto

Field	Type	Required	Description
`statusCode`	`number`	required	HTTP status code Example: `401`
`error`	`string`	required	HTTP status text / exception name Example: `Unauthorized`
`message`	`string`	required	Human-readable message Example: `Invalid credentials`
`code`	`string`	required	Stable, machine-readable error code — branch on this, not the message Example: `INVALID_CREDENTIALS`

Example response

{
  "statusCode": 401,
  "error": "Unauthorized",
  "message": "Invalid credentials",
  "code": "INVALID_CREDENTIALS"
}

Try it

curl -X POST 'https://api.example.com/auth/mfa/setup-totp' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -d '{"label":"ada@acme.com (Acme Corp)","deviceName":"iPhone Authenticator"}'

POST /auth/mfa/setup-totp

Setup TOTP Device

Request body

Responses

Try it

On this page