> ## Documentation Index
> Fetch the complete documentation index at: https://docs.evolutionfoundation.com.br/llms.txt
> Use this file to discover all available pages before exploring further.

# Setup TOTP authentication

> Setup Time-based One-Time Password (TOTP) authentication



## OpenAPI

````yaml /api-reference/openapi/Evo-Auth-Service/multi-factor-authentication.yaml post /api/v1/mfa/setup_totp
openapi: 3.0.1
info:
  title: Evolution Foundation - Auth Service - Multi Factor Authentication
  description: Authentication and user and account management
  version: v1.0.0
servers:
  - url: https://api.evoai.app
    description: Production server
  - url: http://localhost:3001
    description: Development server
    variables:
      port:
        default: '3001'
  - url: '{customUrl}'
    description: Custom server
    variables:
      customUrl:
        default: https://your-instance.com
        description: Enter your server URL
security: []
paths:
  /api/v1/mfa/setup_totp:
    post:
      summary: Setup TOTP authentication
      description: Setup Time-based One-Time Password (TOTP) authentication
      operationId: setupTOTP
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                password:
                  type: string
                  description: Current user password for verification
              required:
                - password
      responses:
        '200':
          description: TOTP setup successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MFASetupResponse'
        '400':
          description: Bad Request (invalid data)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                invalid_password:
                  summary: Invalid password
                  value:
                    success: false
                    error:
                      code: VALIDATION_ERROR
                      message: Invalid password or TOTP already enabled
                    meta:
                      timestamp: '2024-01-15T10:30:00Z'
                      path: /api/v1/mfa/setup_totp
                      method: POST
                totp_already_enabled:
                  summary: TOTP already enabled
                  value:
                    success: false
                    error:
                      code: VALIDATION_ERROR
                      message: TOTP is already enabled for this user
                    meta:
                      timestamp: '2024-01-15T10:30:00Z'
                      path: /api/v1/mfa/setup_totp
                      method: POST
        '401':
          description: Unauthorized (invalid or missing token)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                unauthorized:
                  summary: Unauthorized access
                  value:
                    success: false
                    error:
                      code: INVALID_TOKEN
                      message: Invalid token
                    meta:
                      timestamp: '2024-01-15T10:30:00Z'
                      path: /api/v1/mfa/setup_totp
                      method: POST
        '403':
          description: Forbidden (insufficient permissions)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                forbidden:
                  summary: Access forbidden
                  value:
                    success: false
                    error:
                      code: FORBIDDEN
                      message: You do not have permission to access this resource
                    meta:
                      timestamp: '2024-01-15T10:30:00Z'
                      path: /api/v1/mfa/setup_totp
                      method: POST
        '404':
          description: Not Found (resource not found)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                not_found:
                  summary: User not found
                  value:
                    success: false
                    error:
                      code: NOT_FOUND
                      message: User not found
                    meta:
                      timestamp: '2024-01-15T10:30:00Z'
                      path: /api/v1/mfa/setup_totp
                      method: POST
        '500':
          description: Internal Server Error (server error)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                internal_error:
                  summary: Internal server error
                  value:
                    success: false
                    error:
                      code: INTERNAL_ERROR
                      message: An unexpected error occurred
                    meta:
                      timestamp: '2024-01-15T10:30:00Z'
                      path: /api/v1/mfa/setup_totp
                      method: POST
      security:
        - ApiAccessTokenAuth: []
components:
  schemas:
    MFASetupResponse:
      type: object
      properties:
        success:
          type: boolean
          example: true
        data:
          type: object
          properties:
            secret:
              type: string
              description: TOTP secret (only for TOTP setup)
            qr_code_url:
              type: string
              description: QR code URL (only for TOTP setup)
            backup_codes:
              type: array
              items:
                type: string
              description: MFA backup codes
        message:
          type: string
    ErrorResponse:
      type: object
      required:
        - success
        - error
        - meta
      properties:
        success:
          type: boolean
          example: false
        error:
          type: object
          required:
            - code
            - message
          properties:
            code:
              type: string
              example: VALIDATION_ERROR
            message:
              type: string
              example: Validation failed
            details:
              type: object
              additionalProperties: true
              nullable: true
        meta:
          type: object
          required:
            - timestamp
            - path
            - method
          properties:
            timestamp:
              type: string
              format: date-time
              example: '2024-01-15T10:30:00Z'
            path:
              type: string
              example: /api/v1/super_admin/accounts/123
            method:
              type: string
              example: POST
  securitySchemes:
    ApiAccessTokenAuth:
      type: apiKey
      in: header
      name: api_access_token
      description: API access token authentication

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.