curl -X POST "<API_ENDPOINT>/api/v1/platform/2fa/setup" \
  -H "Authorization: Bearer your_jwt_token"

const response = await fetch('<API_ENDPOINT>/api/v1/platform/2fa/setup', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${token}`,
  },
});

const { secret, qrCode } = await response.json();

// Display QR code for user to scan
console.log('Scan this QR code:', qrCode);

{
  "success": true,
  "secret": "JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP",
  "qrCode": "otpauth://totp/Mavibase:user@example.com?secret=JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP&issuer=Mavibase",
  "message": "Scan the QR code with your authenticator app, then verify with a code"
}

curl -X POST "<API_ENDPOINT>/api/v1/platform/2fa/setup/verify" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer your_jwt_token" \
  -d '{
    "code": "123456"
  }'

const response = await fetch(
  '<API_ENDPOINT>/api/v1/platform/2fa/setup/verify',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      Authorization: `Bearer ${token}`,
    },
    body: JSON.stringify({
      code: '123456',
    }),
  }
);

const result = await response.json();

if (result.success) {
  // Store backup codes securely
  console.log('Backup codes:', result.backupCodes);
}

{
  "success": true,
  "message": "Two-factor authentication enabled",
  "backupCodes": [
    "XXXX-XXXX-XXXX",
    "YYYY-YYYY-YYYY",
    "ZZZZ-ZZZZ-ZZZZ",
    "AAAA-AAAA-AAAA",
    "BBBB-BBBB-BBBB"
  ]
}

curl -X POST "<API_ENDPOINT>/api/v1/platform/2fa/verify" \
  -H "Content-Type: application/json" \
  -d '{
    "tempToken": "temp_abc123xyz",
    "code": "123456"
  }'

async function loginWith2FA(email, password) {
  // Step 1: Initial login
  const loginResponse = await fetch(
    '<API_ENDPOINT>/api/v1/platform/auth/login',
    {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ email, password }),
    }
  );

  const loginData = await loginResponse.json();

  if (loginData.requires2FA) {
    // Step 2: Prompt user for 2FA code
    const code = await promptUserForCode();

    // Step 3: Verify 2FA
    const verifyResponse = await fetch(
      '<API_ENDPOINT>/api/v1/platform/2fa/verify',
      {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({
          tempToken: loginData.tempToken,
          code: code,
        }),
      }
    );

    return verifyResponse.json();
  }

  return loginData;
}

{
  "success": true,
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "id": "usr_abc123",
    "email": "user@example.com",
    "name": "John Doe"
  }
}

curl -X POST "<API_ENDPOINT>/api/v1/platform/2fa/resend" \
  -H "Content-Type: application/json" \
  -d '{
    "tempToken": "temp_abc123xyz"
  }'

{
  "success": true,
  "message": "Verification code resent"
}

curl -X POST "<API_ENDPOINT>/api/v1/platform/2fa/disable" \
  -H "Authorization: Bearer your_jwt_token"

{
  "success": true,
  "message": "Confirm with your authenticator code to disable 2FA"
}

curl -X POST "<API_ENDPOINT>/api/v1/platform/2fa/disable/confirm" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer your_jwt_token" \
  -d '{
    "code": "123456"
  }'

async function disable2FA(code) {
  // Step 1: Request disable
  await fetch('<API_ENDPOINT>/api/v1/platform/2fa/disable', {
    method: 'POST',
    headers: { Authorization: `Bearer ${token}` },
  });

  // Step 2: Confirm with code
  const response = await fetch(
    '<API_ENDPOINT>/api/v1/platform/2fa/disable/confirm',
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        Authorization: `Bearer ${token}`,
      },
      body: JSON.stringify({ code }),
    }
  );

  return response.json();
}

{
  "success": true,
  "message": "Two-factor authentication disabled"
}

{
  "success": false,
  "error": {
    "code": "INVALID_CODE",
    "message": "Invalid verification code"
  }
}

{
  "success": false,
  "error": {
    "code": "EXPIRED_TOKEN",
    "message": "Temporary token has expired. Please login again."
  }
}

{
  "success": false,
  "error": {
    "code": "RATE_LIMITED",
    "message": "Too many verification attempts. Please try again later.",
    "retryAfter": 300
  }
}