Enable TOTP
Profile & security
Enable TOTP
Session-only. Confirm enrollment with a live 6-digit code from the authenticator. Two-factor enforcement starts when this succeeds.
POST
Enable TOTP
Authorizations
Browser session cookie minted by POST /auth/login (or passkey
login). httpOnly, SameSite=Lax, 24 h TTL. Endpoints marked
Session-only accept only this credential and return
403 session_required for API keys.
Body
application/json
Pattern:
^[0-9]{6}$