# Enable 2FA
## Endpoint
`/api/user/2fa/enable`
## Method
GET
## Description
Enables two-factor authentication for the current logged in user account. This API call can only be called after the Initialize 2FA API call (`/api/user/2fa/init`). The user must provide a valid TOTP code generated by their authenticator app to verify the setup.
## Parameters
| `token` | string | Yes | - | The session token generated **only** by the `login` call (API tokens from `createToken` cannot be used). |
| `totp` | string | Yes | - | The 6-digit code from the authenticator app, verifying the user has correctly configured the TOTP secret from the init step. |
## Authentication
Requires a session token from the `login` call ONLY. API tokens from `createToken` are not permitted.
## Response Fields
| `status` | string | `"ok"` on success. |
## Conditional Logic Notes
- This endpoint MUST be called after `/api/user/2fa/init`. Calling it without a prior init call will fail because there is no pending TOTP secret to verify against.
- The `totp` parameter is always required for this endpoint (not conditionally required), as its purpose is to verify that the authenticator app is correctly configured.
- Only login session tokens are accepted; API tokens cannot be used.
## Edge Cases
- This is step 2 of a two-step process. The init step must be completed first.
- If the TOTP code is incorrect (does not match the secret from the init step), the enable call will fail and 2FA will remain disabled.
- Once enabled, subsequent login calls will require the `totp` parameter.
- The token restriction (login-only, no API tokens) is consistent with all 2FA and password management endpoints.