> ## Documentation Index
> Fetch the complete documentation index at: https://orchestrator-docs.hexoforge.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Start TOTP setup

> Generate a pending TOTP secret for the authenticated user.

Creates a TOTP secret in a pending state. Requires `X-API-Key` and **Bearer** access token.

<Info>
  Send both `X-API-Key` and `Authorization: Bearer`. Complete setup with [Verify TOTP setup](/api-reference/public/totp-verify-setup) within **5 minutes**.
</Info>

## Response

**200 OK**

```json theme={null}
{
  "secret": "JBSWY3DPEHPK3PXP",
  "uri": "otpauth://totp/MyApp:user@example.com?secret=JBSWY3DPEHPK3PXP&issuer=MyApp"
}
```

<ResponseField name="secret" type="string">
  Base32 secret for manual entry.
</ResponseField>

<ResponseField name="uri" type="string">
  `otpauth` URI for QR apps.
</ResponseField>

## Status codes

| Code | Meaning                                                 |
| ---- | ------------------------------------------------------- |
| 200  | Secret generated (pending verification)                 |
| 400  | TOTP already enabled                                    |
| 401  | Invalid token                                           |
| 403  | TOTP disabled for project, IP blocked, or firewall deny |