Skip to main content
Wraps the Create TOTP endpoint. Call this method to create a new TOTP instance for a user. The user can use the authenticator application of their choice to scan the returned QR code or enter the returned secret.
If a user has enrolled another MFA method, this method will require MFA. See the Multi-factor Authentication section for more details.

Parameters

int
The expiration for the TOTP instance. If the newly created TOTP is not authenticated within this time frame the TOTP will be unusable. Defaults to 1440 (1 day) with a minimum of 5 and a maximum of 1440.

Response

string
The unique ID for a TOTP instance.
string
The TOTP secret key shared between the authenticator app and the server used to generate TOTP codes.
string
The QR code image encoded in base64.
array[strings]
The recovery codes used to authenticate the user without an authenticator app.
string
Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
number
The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
string
The unique ID of the affected User.
object
The user object affected by call. See the User object for complete response field details.