Set OTP secret

SetManagerOTP¶

Description: Verifies a TOTP code for the provided secret and, if valid, stores this secret for the current manager account.

If OTP is already enabled, secret rotation is allowed, but the request must also include current_code generated from the currently active secret.

🛡️ Access Level Required: SESSION_MANAGER, SESSION_ADMIN, or SESSION_DEALER

Name	Type	Required	Description
secret	string	Yes	New Base32 TOTP secret
code	string	Yes	Current TOTP code generated from the new secret
current_code	string	No	Current TOTP code from the already active secret. Required only when OTP is already enabled

{
  "secret": "JBSWY3DPEHPK3PXP",
  "code": "123456"
}

{
  "secret": "MZXW6YTBOI======",
  "code": "654321",
  "current_code": "123456"
}

Name	Type	Description
otp_enabled	int	`1` when OTP is now enabled for the manager

{
  "otp_enabled": 1
}

{
  "error": "INVALID_OTP_CODE"
}

{
  "error": "INVALID_CURRENT_OTP_CODE"
}

{
  "error": "CURRENT_OTP_REQUIRED"
}

{
  "error": "INVALID_OTP_SECRET"
}

{
  "error": "MANAGER_NOT_FOUND"
}

{
  "error": "OTP_CANT_SET"
}