---
title: "Service: /self/authenticators [POST]"
source: https://dev.pageseeder.com/api/services/authenticators-self-POST.html
description: "Creates a multi-factor authentication (MFA) authenticator for the signed-in member. Supports email-otp, sms-otp, totp, webauthn, and recovery code types with configurable parameters and usage limits."
last_updated: 2026-09-02T11:36:08+10:00
document_type: api_endpoint
operation_id: member-POST
resource_id: member
path_template: /self/authenticators
http_method: POST
api_category: member
implementation_version: 6.2004
api_since: 6.2000
deprecated_since: null
obsolete_since: null
api_support: experimental
cache_control: N/A
generated_at: 2026-09-02
tokens: ~798
---

# /self/authenticators \[POST\]

## Description

Create an authenticator for the signed-in member.

The type parameter allows these values provided they are included in the `mfaSupport` [global property](../../guide/configuration/properties/global_properties.md):

- `email-otp` for One-Time Passwords sent by email
- `sms-otp` for One-Time Passwords sent by email
- `totp` for authenticator apps using a Time-based One-Time Password (TOTP) algorithm
- `webauthn` for security keys, external devices and built-in authenticators like fingerprint scanners
- `recovery` for a batch of 10 single-use backup codes

There are limits on the number of authenticators that each member can have:

- 10 Webauthn authenticators
- 3 TOTP authenticators
- 1 for each other type of authenticator

The phone number is required for `sms-otp` authenticators and it should use the E164 format including the country code (e.g. +61123456789).

The name parameter is optional and can be used in place of the default one.

The email address is optional and can be used as an alternative email address to the one the member is registered to. By the default the email-otp authenticator uses the current email address of the member.

The digits parameter lets you set the length of the code for TOTP authenticator apps. Supported values are 6, 7 and 8.

The algorithm parameter lets you set the algorithm to use for TOTP authenticator apps. Supported values are `sha1`, `sha256` and `sha512` .

> **Note:** Beware that many authenticator apps only support the defaults from the TOTP algorithm.

## Parameters

| Name | Description | Required | Type | Default value |
| --- | --- | --- | --- | --- |
| algorithm | The algorithm to use for `totp` authenticators | no | string | `sha1` |
| attachment | How `webauthn` is attached (can be 'platform' or 'cross-platform') | no | enum |  |
| digits | The number of digits of the `totp` authenticator | no | string | `6` |
| email | The email address for the `email-otp` type | no | string | `[member email]` |
| hints | Comma-separated list of `webauthn` hints (can include 'security-key', 'client-device', 'hybrid') | no | string |  |
| name | The name of the authenticator | no | string |  |
| phone | The phone number for the `sms-otp` type, required if type is `sms-otp` | conditional | string |  |
| type | The type of authenticator to create | yes | string |  |

## Permission

Only the member themselves can invoke this service.

## Response

The returned XML is as follows:

```xml
 <authenticator-creation>
   <authenticator id="[id]"
           public-id="[public id]"
           name="[name]"
           type="[type]"
           member="[member id]"
           verified="[true|false]"
           created="[created date]"
           data="[data]"
           [last-used="[date last used for authentication]"]>
     [<parameters [digits="6"]
                  [algorithm="sha1"]
                  [attachment="[platform|cross-platform]"]
                  [hints="[security-key|client-device|hybrid]"]
                  [transports="[...]"]/>
   </authenticator>
 </authenticator-creation>
 
```

## Error handling

No specific errors expected for this generator.