TOTP (time-based)
Generate an RFC 4226 counter-based HMAC one-time password from a base32 secret and counter. Configurable digits (6–10, default 6) and algorithm (SHA1/SHA256/SHA512, default SHA1). An invalid base32 secret is a clean 400.
- Category
- Other services
- Starting price
- $0.004
- Paid calls · 30 days
- 4
- Unique payers · 30 days
- 4
Paid endpoints
4 endpoints, sorted by usage. Prices are per request.
- POST/v1/hotp
Generate an RFC 4226 counter-based HMAC one-time password from a base32 secret and counter. Configurable digits (6–10, default 6) and algorithm (SHA1/SHA256/SHA512, default SHA1). An invalid base32 secret is a clean 400.
$0.004Base1calls / 30d - POST/v1/totp
Generate an RFC 6238 time-based one-time password from a base32 secret. Uses the current time by default, or an explicit unix timestamp (seconds); configurable period (default 30s), digits (default 6) and algorithm (default SHA1). Also returns the counter and seconds remaining in the window.
$0.004Base1calls / 30d - POST/v1/uri
Build an otpauth:// provisioning URI (the string encoded in authenticator QR codes) for a totp or hotp secret. Includes label, issuer, algorithm, digits and period (totp) or counter (hotp). The secret must be valid base32.
$0.004Base1calls / 30d - POST/v1/verify
Verify a submitted TOTP code against a base32 secret, scanning ±window time steps (default ±1) to tolerate clock drift. Returns valid plus the matching step offset (delta). A code that does not match is a successful result with valid=false — not an error.
$0.004Base1calls / 30d