# Set up TOTP for a new user

> Source: https://docs.clonepartner.com/api-reference/auth/setup-totp/

`POST /api/auth/setup-totp`

Generates a TOTP secret for a user who doesn't have one yet. Requires a pending
session cookie (from login). The user must verify the code via /api/auth/verify-totp
to complete enrollment. If an unverified enrollment was abandoned, clients may
send `force: true` to restart enrollment and replace the unverified secret.

**Operation ID:** `setupTotp`

## Authentication

No authentication is required.

## Request body

### `application/json`

- Type: `object`
- Properties:
  - `force` (`boolean`) — Replace an existing unverified TOTP secret for this pending session

## Success responses

### 200

TOTP enrollment data

**Content type:** `application/json`

- Type: `object`
- Properties:
  - `totp_secret` (`string`)
  - `totp_uri` (`string`)

## Error responses

### 400

TOTP already configured, or enrollment already started and `force` was not provided

**Content type:** `application/json`

- Reference: `Error`
  - Type: `object`
  - Properties:
    - `error` (`string`)
      - Example: `NOT_FOUND`
    - `message` (`string`)
      - Example: `Resource not found`

### 401

Not authenticated

**Content type:** `application/json`

- Reference: `Error`
  - Type: `object`
  - Properties:
    - `error` (`string`)
      - Example: `NOT_FOUND`
    - `message` (`string`)
      - Example: `Resource not found`

Example:

```json
{
  "error": "AUTH_ERROR",
  "message": "Not authenticated"
}
```

### 429

Too many requests

**Content type:** `application/json`

- Reference: `Error`
  - Type: `object`
  - Properties:
    - `error` (`string`)
      - Example: `NOT_FOUND`
    - `message` (`string`)
      - Example: `Resource not found`

Example:

```json
{
  "error": "RATE_LIMITED",
  "message": "Too many failed TOTP attempts. Try again later."
}
```

## Examples

### cURL

```bash
curl --request POST \
  --url 'https://your-envoy.example.com/api/auth/setup-totp' \
  --header 'Content-Type: application/json' \
  --data '{
  "force": true
}'
```

### JavaScript (fetch)

```javascript
const response = await fetch('https://your-envoy.example.com/api/auth/setup-totp', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "force": true
  }),
});

if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = response.status === 204 ? null : await response.json();
console.log(data);
```