Generates a new secret key for setting up multi-factor authentication (MFA) for login and operation confirmation processes.
Generate MFA Secret Key
Deprecated: This endpoint is deprecated. Consult the latest Netevia API documentation for the recommended MFA setup workflow.
The GET /api/generateSecret endpoint generates a new secret key used to configure multi-factor authentication (MFA) for a user account. The returned key is intended for use with TOTP-based authenticator applications such as Google Authenticator or Authy. When MFA is active, users must provide a time-based one-time password (TOTP) in addition to their primary credentials during login and when confirming sensitive operations such as transfers.
Endpoint
GET /api/generateSecret
Authentication
Bearer token required. Obtain via:
POST https://api.banking.netevia.dev/api/auth/v2Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.
When to use
Call this endpoint when onboarding a user who needs to enable MFA or when a user needs to re-enroll their authenticator app (for example, after switching devices). The generated secret should be presented to the user immediately so they can scan the QR code or manually enter the key into their authenticator app. Do not call this endpoint repeatedly for the same user without completing or invalidating the previous enrollment, as each call issues a new secret.
Query Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
| useQR | boolean | No | When true (default), the response contains a QR code URL that can be scanned directly by an authenticator app. When false, the raw secret key string is returned instead. |
Response
200 OK
The response body is a plain string. Its content depends on the useQR parameter:
useQR=true(default): Aotpauth://URI or a URL pointing to a QR code image that encodes the TOTP configuration.useQR=false: The raw Base32-encoded secret key string to be entered manually into an authenticator app.
| Field | Type | Description |
|---|---|---|
| (response body) | string | QR code URI/URL (when useQR=true) or raw Base32 secret key (when useQR=false). |
"otpauth://totp/Netevia:user%40example.com?secret=JBSWY3DPEHPK3PXP&issuer=Netevia"Error Codes
| Code | When it happens |
|---|---|
| 401 | Token missing, expired, or invalid |
| 403 | Insufficient permissions |
| 500 | Internal server error |
Common Mistakes
- Discarding the returned secret before the user has had a chance to register it in their authenticator app — the secret cannot be retrieved again after this call.
- Calling this endpoint multiple times in quick succession, which invalidates earlier secrets and breaks in-progress enrollments.
- Ignoring the
deprecatedstatus of this endpoint — check the Netevia API changelog for the current MFA enrollment flow before building new integrations. - Storing the raw secret in an insecure location; it must be protected with the same care as a password.
Related Endpoints
POST /api/auth/v2— Obtain a Bearer token (required before calling this endpoint)POST /api/auth/refresh— Refresh an expiring Bearer token
Example
# Request with QR code URL (default)
curl -X GET "https://api.banking.netevia.dev/api/generateSecret?useQR=true" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Accept: application/json"# Request raw secret key without QR
curl -X GET "https://api.banking.netevia.dev/api/generateSecret?useQR=false" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Accept: application/json"