I'm working on automating a 2FA login flow for testing/scripting purposes using the FusionAuth API. My environment currently does not have SMTP configured, so I cannot rely on standard email delivery for the OTP.

I want to handle the 2FA authentication step purely via API using my FusionAuth API Key. Could anyone guide me on the best approach to achieve this?

Specifically, I have a few ideas based on the documentation but would love some community validation:

Provide a custom code: I noticed that the /api/two-factor/start endpoint allows you to pass a custom code in the request body. Is this the recommended way to bypass external delivery mechanisms during automation?

Use TOTP (Authenticator): Should I instead enable TOTP for the test user, grab the secretBase32Encoded via the /api/two-factor/secret endpoint, and programmatically generate the 6-digit code inside my test script using a TOTP library?

If anyone has a quick cURL example or best practice recommendations for handling this flow purely via API, I'd really appreciate it!

Thanks in advance!