Skip to main content
POST
Start two-factor setup

Authorizations

Authorization
string
header
required

The session token qumod login obtains through the device flow (POST /v1/auth/device/token). It acts as the signed-in user, like a console session, and needs no CSRF token.

Response

The provisional secret and backup codes. The backup codes are shown only here.

secret
string
required

The shared secret (base32), for manual entry into an authenticator app.

Example:

"JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP"

uri
string
required

An otpauth:// URI to render as a QR code.

Example:

"otpauth://totp/Qumo%20Deploy:[email protected]?secret=JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP&issuer=Qumo%20Deploy"

backup_codes
string[]
required

One-time recovery codes. Shown only here.

Example: