# Prepare an authenticator app

> A new secret for an authenticator app, made by the server - with a session only.

- Effect: Read - Changes nothing.
- Idempotent: no
- Stability: beta
- REST: `POST https://api.manitu.de/v1/access/tfa/totp/prepare`
- Page: /reference/access/tfa/totp/prepare/

## REST

`POST https://api.manitu.de/v1/access/tfa/totp/prepare`

### Authentication

One of `X-API-Key`, `Authorization: Bearer …` - never more than one in a request.

### Request body

JSON; unknown fields are refused.

No fields - send {} or no body.

### Response

In `data`; the rest of the body as on every call.

- `secret` (string, required) - The secret (base32), to type into the app.
- `uri` (string, required) - otpauth:// URI, for a QR code.
- `setup_token` (string, required) - For access/tfa/totp/create, with the secret and a code from the app.
- `expires_at` (string, required) - (format `date-time`)

### Statuses

- `200` Success.
- `400` The request does not match the declared input schema.
- `401` No credential was presented, or it was not recognised.
- `403` The credential is not permitted to use this operation.
- `500` The server failed. Nothing about the request was wrong. Whether a change took effect is not known - check before trying it again.
- `503` The channel this operation forwards through is unavailable.

### Example

```sh
curl -X POST 'https://api.manitu.de/v1/access/tfa/totp/prepare' \
  -H 'X-API-Key: $API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{}'
```

## Example result

```json
{
  "secret": "string",
  "uri": "string",
  "setup_token": "eyJwYWdlIjoyfQ",
  "expires_at": "2026-10-23T12:00:00+02:00"
}
```