MFA

TOTP multi-factor authentication device management

📄️List the authenticated user's verified MFA devices

List the authenticated user's verified MFA devices

📄️Start enrolling a new TOTP device

Returns a TOTP secret and QR code URI; the device stays unverified until confirmed via `/verify`. Requires re-authentication (`password` for local/LDAP, TOTP `code` for OIDC step-up) unless this is the very first device on a restricted MFA/reset token. Capped at a configured max devices per user.

📄️Get an MFA device

Get an MFA device

📄️Rename or set an MFA device as default

Rename or set an MFA device as default

📄️Remove an MFA device

Requires re-authentication (password or TOTP step-up) if the device was verified.

📄️Confirm a TOTP device with its first code

Verifies the device and, in the password-reset flow, issues a fresh restricted MFA-reset cookie; otherwise issues full auth cookies and creates a session (this endpoint doubles as 'finish enrollment' and, for the password-reset flow, 'MFA step-up').