Add or update TOTP key for existing end user

Initiate a flow to add TOTP functionality for an existing end user, or to update the TOTP key for an existing end user. Descope will generate a TOTP key (also called a secret or seed) that will be entered into the end user's authenticator app so that TOTP codes can be successfully verified. The new end user will be registered after the full Add / Update TOTP flow has successfully completed. The bearer token requires both the ProjectId and refresh JWT in the format \<Project ID\>:<JWT>, and can therefore only be run for end users who are currently signed-in.

If the end user is not yet registered use the Sign-Up endpoint to register the user.

Next Steps

1. Display the TOTP key to the end user so the key can be entered into the authenticator app. Use any of the following methods to display the key to your end user:
   • (recommended) Redirect the end user session to the provisioningURL returned in the response body. The URL displays the key as a QR code that can be scanned directly from the authenticator app.
   • Render the QR code using your own web page using the image (the QR code as Base64) returned in the response body.
   • If your end user cannot scan a QR code, present the key returned in the response body so the key can be pasted into their authenticator app. If the authenticator app prompts, the end user must select key type: "time based".
2. Prompt the end user user for a TOTP code generated by their authenticator app.
3. Verify the TOTP code using the Sign-In / Verify endpoint to complete the Add / Update process. After successfully verifying the TOTP code the new TOTP key will be used to validate future TOTP code.

See Also

• See The User Object for further details on how to identify users and their contact information such as email addresses and phone number.

Endpoint Authentication

Use authorization bearer header with the following format:

Authorization: Bearer <Project ID:Refresh JWT>

Authorization

Request Body