We need a challenge route that will take the TOTP and generate a token (JWT?) in case of success. This token will be passed in the header of the other requests.