:::endpoint POST /v1/me/two-factor

The first half of turning two-factor on for a signed-in account, as in the
settings screen on the website. Add what comes back to an authenticator, then
send its first code to [confirm](/docs/api/apps/two-factor-confirm).

Asking again makes a new secret and the one before stops counting, until one
has been confirmed. Like the website, this does not ask for the password
again.

An account that has to have two-factor and has none cannot get here: every
request with its token answers `two_factor_setup_required`. The Propper app
sets it up [while signing in](/docs/api/apps/two-factor-setup) instead.

## Request

```bash
curl -X POST https://api.proppertrading.com/v1/me/two-factor \
  -H "Authorization: Bearer ptat_9f2c1a44_3b8e7d2f5c9a1b4e6d8f0a2c4e6b8d1f" \
  -H "Idempotency-Key: 3c5e7a9b-1d2f-4a6c-8e0b-2d4f6a8c0e1b"
```

No body.

## Response

`201`.

```json
{
    "data": {
        "object": "two_factor_secret",
        "secret": "MZXW6YTBOI4HKZLH",
        "otpauth_url": "otpauth://totp/Propper:jamie%40acmefunded.com?secret=MZXW6YTBOI4HKZLH&issuer=Propper&algorithm=SHA1&digits=6&period=30"
    },
    "meta": { "request_id": "req_01kz4bkr1aj1gv63d8fv3133ey" }
}
```

| Field         | Description |
| ------------- | ----------- |
| `secret`      | The key in base32, for typing into an authenticator by hand |
| `otpauth_url` | The same as a link. On an iPhone, opening it offers to add the code to Passwords |

## Errors

| Status | Code                         | Meaning                                                      |
| ------ | ---------------------------- | ------------------------------------------------------------ |
| 400    | `two_factor_already_enabled` | The account already has an authenticator. Turn it off first  |
| 403    | `insufficient_scope`         | This device does not hold `me:write`                         |