OTP

The request body must be JSON:

• action"secret" | "generate" | "verify"required

  Action to perform: secret, generate, or verify

• secretstringconditional

  Base32 secret key (required for generate and verify)

• codestringconditional

  OTP code to verify (required for verify)

• labelstringoptional

  Account label for the otpauth:// URI (used with secret action)

• issuerstringoptional

  Issuer name for the otpauth:// URI (used with secret action)

• algorithm"sha1" | "sha256" | "sha512"optional

  HMAC algorithm: sha1 (default), sha256, or sha512

• digits"6" | "8"optional

  Code length: 6 (default) or 8

• period"15" | "30" | "60"optional

  TOTP period in seconds: 15, 30 (default), or 60

• counternumberoptional

  HOTP counter (integer). If provided, HOTP mode is used instead of TOTP

Implements RFC 4226 (HOTP) and RFC 6238 (TOTP). Compatible with Google Authenticator and Aegis.

secret action:

• secretstring

  Base32-encoded secret key

• uristring

  otpauth:// URI for QR code generation

generate action:

• codestring

  Generated OTP code

• typestring

  totp or hotp

verify action:

• validboolean

  Whether the code is valid

• driftnumber

  Time drift detected (0, +1, or -1)

If parameters are missing or invalid, the API will return an error:

• 400Action is requiredThe action parameter is missing
• 400Action must be one of: secret, generate, verifyThe action value is not valid
• 400Secret is requiredThe secret parameter is missing
• 400Code is requiredThe code parameter is missing for verify
• 400Digits must be 6 or 8The digits value is not valid
• 400Period must be one of: 15, 30, 60The period value is not valid
• 400Algorithm must be one of: sha1, sha256, sha512The algorithm value is not supported
• 400Counter must be a non-negative integerThe counter value is invalid