TOTP / 2FA Codes API

Add two-factor authentication: create TOTP secrets with an otpauth:// QR code for Google Authenticator, compute and verify 6–8 digit codes (RFC 6238 / HOTP).

GETPOSThttps://apibox.io.vn/v1/totp

Security & Crypto▶ Try it online

The TOTP API gives your application two-factor authentication without a library. action=generate creates a random Base32 secret and its otpauth:// URI, with your issuer and the user’s account; action=qr returns the same as a PNG or SVG QR code to scan with Google Authenticator, Microsoft Authenticator, Authy or 1Password. action=verify with secret and code checks a code typed by the user, accepting one time step of clock drift by default (window).

action=code returns the current and next codes and how many seconds the current one remains valid. SHA-1 (the default every app supports), SHA-256 and SHA-512, 6 or 8 digits and other periods are supported, as well as counter-based HOTP (RFC 4226) with type=hotp; codes match the RFC test vectors.

Nothing is stored: the secret travels with each request and responses are not cached. Keep secrets encrypted in your own database, prevent replay by remembering the last accepted time_step per user, and rate-limit verification attempts.

Parameters

Name	In	Type	Required	Default
`action`	body\|query	string	no	`generate`	`generate`, `qr`, `code` or `verify` (guessed from the other parameters).
`secret`	body\|query	string	no		Base32 secret (for code / verify; optional for generate).
`code`	body\|query	string	no		Code to verify.
`issuer`	body\|query	string	no		Your app name shown in the authenticator.
`account`	body\|query	string	no		User label, e.g. an email.
`digits`	body\|query	number	no	`6`	6–8 digits.
`period`	body\|query	number	no	`30`	Time step in seconds.
`algorithm`	body\|query	string	no	`SHA1`	`SHA1`, `SHA256` or `SHA512`.
`window`	body\|query	number	no	`1`	Accepted drift in time steps (verify).
`type`	body\|query	string	no	`totp`	`totp` or `hotp` (with `counter`).

Example

curl "https://apibox.io.vn/v1/totp?issuer=APIBox&account=an@example.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch('https://apibox.io.vn/v1/totp?issuer=APIBox&account=an@example.com', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
  },
});
const data = await res.json();
console.log(data);

import requests

res = requests.get(
    "https://apibox.io.vn/v1/totp?issuer=APIBox&account=an@example.com",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/totp?issuer=APIBox&account=an@example.com');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

Response

{
  "type": "totp",
  "secret": "OW7IHR3GMA57QTCFYF2WJ42XSPPCCUM7",
  "otpauth_uri": "otpauth://totp/APIBox%3Aan%40example.com?secret=OW7IHR3GMA57QTCFYF2WJ42XSPPCCUM7&issuer=APIBox&algorithm=SHA1&digits=6&period=30",
  "algorithm": "SHA1",
  "digits": 6,
  "period": 30,
  "current_code": "978344",
  "note": "Store the secret encrypted on your server; show the QR code (action=qr) once to the user."
}

Use cases

Add 2FA to a SaaS login in an afternoon
Admin panels and internal tools that need a second factor
Test authenticator flows in QA
Generate codes for service accounts in scripts

FAQ

Is it compatible with Google Authenticator?

Yes, with the defaults (SHA-1, 6 digits, 30 seconds). Some apps ignore other algorithms or periods.

Do you keep the secret?

No. It is only used to compute the answer and the responses carry Cache-Control: no-store. Store it yourself, encrypted.

How do I stop a code from being reused?

verify returns time_step; save the last accepted one per user and reject codes with the same or an older step.

TOTP / 2FA Codes API

Parameters

Example

Response

Use cases

FAQ

Related APIs

Hash Generator

Encode / Decode

Password Generator