# Enrol an Authenticator App

> Coming soon, upon request — this feature is turned on for your tenant by the Aurea team. [Contact us](https://www.aureahub.com/contact)

A new secret for an authenticator app, shown once. It becomes your second factor once its first code is confirmed.

## Overview

- `201` with `secret` (base32, 32 characters), `otpauthUri` — show it as a QR code: the app lists it under your tenant's name and the username — and `expiresAt`, 15 minutes from now. No body. `Cache-Control: no-store`.
- Then [Confirm the App](https://docs.aureahub.com/docs/mfa-totp-confirm.md) with a code it shows. A factor already enrolled stays until then.
- `409` `MFA_OFF` where second factors are not in use; `403` `MFA_NOT_AVAILABLE` for an End User. 20 requests per minute per client IP.

## Endpoint

### `POST /v1/auth/mfa/totp`

Authentication: bearer token required.

Starts enrolling an authenticator app.

**Responses**

`201` Created

```json
{
  "secret": "JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP",
  "otpauthUri": "otpauth://totp/Acme%20Bank:marco.cfo?secret=JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP&issuer=Acme+Bank&algorithm=SHA1&digits=6&period=30",
  "expiresAt": "2026-10-09T09:15:00.000Z"
}
```

`409` Off

```json
{
  "statusCode": 409,
  "error": "ConflictError",
  "message": "Second factors are not in use for this account",
  "details": { "code": "MFA_OFF" }
}
```

`403` End User

```json
{
  "statusCode": 403,
  "error": "ForbiddenError",
  "message": "A second factor is for the accounts that administer",
  "details": { "code": "MFA_NOT_AVAILABLE" }
}
```

**Example request**

```bash
curl -X POST https://api.aureahub.com/v1/auth/mfa/totp \
  -H "Authorization: Bearer $ACCESS_TOKEN"
```

---

Web version: https://docs.aureahub.com/#mfa-totp-start