POST/v1/auth/token/two-factor/setup

The first half of setting up two-factor during a sign-in, for the Propper app. Send the challenge from a sign-in that answered two_factor_setup_required, and add what comes back to an authenticator app.

Asking again makes a new secret, and the one before it stops working. Only the entry added last can confirm.

Request

curl -X POST https://api.proppertrading.com/v1/auth/token/two-factor/setup \
  -H "Content-Type: application/json" \
  -d '{"challenge": "c3a91f0e5b7d2c4e6a8f1b3d5c7e9a0b2d4f6a8c1e3b5d7f9a0c2e4b6d8f1a3c"}'

Response

{
    "data": {
        "object": "two_factor_secret",
        "secret": "MZXW6YTBOI4HKZLH",
        "otpauth_url": "otpauth://totp/Propper:jamie%40acmefunded.com?secret=MZXW6YTBOI4HKZLH&issuer=Propper&algorithm=SHA1&digits=6&period=30"
    },
    "meta": { "request_id": "req_01kz4bkr1aj1gv63d8fv3133ey" }
}

Field	Description
`secret`	The key in base32, for typing into an authenticator by hand
`otpauth_url`	The same as a link. On an iPhone, opening it offers to add the code to Passwords, which then fills it in by itself

The secret is written to the account straight away, but it does not count until it is confirmed. Until then the account still has no two-factor.

Errors

Status	Code	Meaning
401	`expired_two_factor_challenge`	Expired, already used, not a setup challenge, or two-factor was set up somewhere else in the meantime. Start again from the password
422	`validation_failed`	No challenge, or not one in the right shape
429	`rate_limit_exceeded`	Shares the limit of the two-factor step

Get a secret to set up two-factor

Request

Response

Errors