Enroll a new TOTP factor
Auth
Enroll a new TOTP factor
Returns the TOTP secret + provisioning URI for a QR code. Factor starts in unverified state until /auth/mfa/verify is called against it.
POST
Enroll a new TOTP factor
Authorizations
HttpOnly, Secure, SameSite=Lax cookie issued by /v1/auth/sign-in (or the SSO / email-callback flows). The value is an AES-256-GCM-encrypted blob of {access_token, refresh_token, issued_at, auth_method}. Browser clients include this automatically with credentials: "include".
Body
application/json