Start authenticator app setup
const url = 'https://api.aetherpush.com/v1/mfa/totp/setup';const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.aetherpush.com/v1/mfa/totp/setup \ --header 'Authorization: Bearer <token>'Session-only. Generates a TOTP secret and returns it with an
otpauth:// URI for the QR code. Repeating the call before
confirmation replaces the pending secret. Confirm with
/v1/mfa/totp/verify; until then the authenticator does not count
as an MFA method.
Authorizations
Section titled “Authorizations”Responses
Section titled “Responses”Secret and provisioning URI, shown once.
object
Base32 secret, shown once for manual entry.
Otpauth:// URI to render as a QR code.
Examplegenerated
{ "secret": "example", "otpauthUri": "example"}Authentication required.
object
Human-readable error message.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "requestId": "req_abc123"}API keys and named access keys receive a plain 403. A login session
that is not a dashboard login session receives code
dashboard_session_required.
object
Human-readable error message.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Returned after login-session validation when a valid session that is
not a dashboard login session tries to issue or widen an API key,
create an access key or change its lifetime, enrol a passkey or
authenticator app, start a passkey step-up challenge, or run the CLI
device ceremony. Endpoints that enforce both guards reject API keys and
named access keys earlier with a plain 403 response and no code.
API-key creation applies only the dashboard-session guard, so any
non-dashboard credential receives this response there. Listing,
renaming and revoking stay open to any login session. Sessions created
before the credential_origin column existed cannot be attributed to
the dashboard and are also refused; signing out and back in fixes that.
object
Example
{ "error": "The requested resource was not found.", "requestId": "req_abc123"}An authenticator is already confirmed; remove it first.
object
Human-readable error message.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "requestId": "req_abc123"}Authenticator codes are not configured on this server.
object
Human-readable error message.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "requestId": "req_abc123"}