# Initialize 2FA
## Endpoint
`/api/user/2fa/init`
## Method
GET
## Description
Initializes two-factor authentication for the current logged in user account. The secret returned by this API call needs to be used with authenticator apps like Microsoft Authenticator or Google Authenticator. This call is the first step to enable 2FA, followed by calling the Enable 2FA API call (`/api/user/2fa/enable`).
## Parameters
| `token` | string | Yes | - | The session token generated **only** by the `login` call (API tokens from `createToken` cannot be used). |
## Authentication
Requires a session token from the `login` call ONLY. API tokens from `createToken` are not permitted.
## Response Fields
| `response.totpEnabled` | boolean | Current 2FA status (expected to be `false` at this stage since 2FA is being initialized, not yet enabled). |
| `response.qrCodePngImage` | string | Base64-encoded PNG image of the QR code for scanning with authenticator apps. |
| `response.secret` | string | The TOTP secret key (e.g., `"RZ56CYOXKAXI5D23"`) to be manually entered into an authenticator app if QR scanning is not available. |
## Conditional Logic Notes
- This is step 1 of a two-step process. After calling this endpoint, the user must configure their authenticator app with the returned secret/QR code, then call `/api/user/2fa/enable` with a valid TOTP code to complete the setup.
- Only login session tokens are accepted; API tokens cannot be used.
## Edge Cases
- The `qrCodePngImage` field is a base64-encoded PNG image, not a URL. Clients need to decode it for display.
- Calling this endpoint does NOT enable 2FA -- it only generates the secret. The Enable 2FA endpoint must be called separately to activate it.
- If called when 2FA is already enabled, behavior is not explicitly documented -- it may regenerate a new secret or return an error.
- The token restriction (login-only, no API tokens) is implied by the docs specifying "session token generated only by the `login` call."