- TOTP secret: /verification/totp/secret (not /verification/totp) - Backup codes: generate via /verification/backup-code/generate first, then bind with the returned verificationId. Cannot bind BackupCode without generating codes first. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>