Prepare an authenticator app

A new secret for an authenticator app, made by the server - with a session only.

RReadNot idempotentbeta

POST

/v1/access/tfa/totp/prepareon https://api.manitu.de

Try it

Not offered over MCP - only to programs over REST.

Authentication

One of X-API-Key, Authorization: Bearer … - never more than one in a request. More

Request body JSON; unknown fields are refused

No fields - send {} or no body.

Response in `data`; the rest of the body as on every call

secretstringrequired

The secret (base32), to type into the app.

uristringrequired

otpauth:// URI, for a QR code.

setup_tokenstringrequired

For access/tfa/totp/create, with the secret and a code from the app.

expires_atstringrequired

Format date-time

Statuses

200Success.400The request does not match the declared input schema.401No credential was presented, or it was not recognised.403The credential is not permitted to use this operation.500The server failed. Nothing about the request was wrong. Whether a change took effect is not known - check before trying it again.503The channel this operation forwards through is unavailable.

POST/v1/access/tfa/totp/prepare

Request

curl -X POST 'https://api.manitu.de/v1/access/tfa/totp/prepare' \
  -H 'X-API-Key: $API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{}'

const response = await fetch('https://api.manitu.de/v1/access/tfa/totp/prepare', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.API_KEY,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
});
const answer = await response.json();

<?php

$curl = curl_init('https://api.manitu.de/v1/access/tfa/totp/prepare');

curl_setopt_array($curl, [
    CURLOPT_CUSTOMREQUEST  => 'POST',
    CURLOPT_HTTPHEADER     => [
        'X-API-Key: ' . getenv('API_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS     => '{}',
    CURLOPT_RETURNTRANSFER => true,
]);

$answer = json_decode(curl_exec($curl), true);

import os

import requests

response = requests.request(
    "POST",
    "https://api.manitu.de/v1/access/tfa/totp/prepare",
    headers={"X-API-Key": os.environ["API_KEY"]},
    json={},
)
answer = response.json()

Response 200

{
  "status": {
    "type": "success",
    "code": 200
  },
  "meta": {},
  "data": {
    "secret": "string",
    "uri": "string",
    "setup_token": "eyJwYWdlIjoyfQ",
    "expires_at": "2026-10-23T12:00:00+02:00"
  }
}

Prepare an authenticator app

Authentication

Request body JSON; unknown fields are refused

Response in data; the rest of the body as on every call

Statuses

Response in `data`; the rest of the body as on every call