Skip to main content
import { StytchClient } from '@stytch/vanilla-js';

const stytch = new StytchClient('${publicToken}');

export const create = () => {
stytch.totps.create({ expiration_minutes: 60 });
};

{
    "status_code": 200,
    "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
    "secret": "BTGNX5RKJRMQWQFRQKTG34JCF6XDRHZS",
    "totp_id": "totp-test-41920359-8bbb-4fe8-8fa3-aaa83f35f02c",
    "qr_code": "data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAMgAAADIEAAAAADYoy0BAAAG8ElEQVR...8EAAD//7dQP/5Y00bRAAAAAElFTkSuQmCC",
    "recovery_codes": [
      "ckss-2skx-ebow",
      "spbc-424h-usy0",
      "hi08-n5tk-lns5",
      "1n6i-l5na-8axe",
      "aduj-eufq-w6yy",
      "i4l3-dxyt-urmx",
      "ayyi-utb0-gj0s",
      "lz0m-02bi-psbx",
      "l2qm-zrk1-8ujs",
      "c2qd-k7m4-ifmc"
    ],
    "user_id": "user-test-16d9ba61-97a1-4ba4-9720-b03761dc50c6",
    "user": {...},
  }
Wraps the Create TOTP endpoint. Call this method to create a new TOTP instance for a user. The user can use the authenticator application of their choice to scan the returned QR code or enter the returned secret.
If a user has enrolled another MFA method, this method will require MFA. See the Multi-factor Authentication section for more details.

​
Parameters

​
expiration_minutes
int
The expiration for the TOTP instance. If the newly created TOTP is not authenticated within this time frame the TOTP will be unusable. Defaults to 1440 (1 day) with a minimum of 5 and a maximum of 1440.

​
Response

​
totp_id
string
The unique ID for a TOTP instance.
​
secret
string
The TOTP secret key shared between the authenticator app and the server used to generate TOTP codes.
​
qr_code
string
The QR code image encoded in base64.
​
recovery_codes
array[strings]
The recovery codes used to authenticate the user without an authenticator app.
​
request_id
string
Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
​
status_code
number
The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
​
user_id
string
The unique ID of the affected User.
​
user
object
The user object affected by this API call. See the Get user endpoint for complete response field details.