Mixing
Is it possible to generate a Twilio “OneCode” TOTP token programmatically?
Goal
I have a backend service that talks to AWS, and an automated tool that acquires AWS creds. The cred-getter has MFA enabled (not my choice), but I don't want to type in or copy a code. Instead, I want to write a bit of code that can programmatically generate or get a TOTP soft-token without texting or calling anyone. So today our workflow is like this:
call cred getter from cli => open authy app for totp code => paste into cli
but i want it to look like this:
call my custom cli => it makes a totp code and passes it to cred getter for me
Question
Is there a way to curl Authy or Twilio to get one of these soft tokens programmatically?
Existing Docs
There's sort of a circular maze of documentation that appears relevant to this question, but I can't break the circle.
-----> Twilio has a page describing TOTP:
| | https://www.twilio.com/authy/features/totp
| |
| | It links to a page describing OTP API access:
| | https://www.twilio.com/authy/api#softtoken
| |
| | That explains you can "build your own SDK-supported mobile authentication application.":
| | https://www.twilio.com/docs/authy/api/one-time-passwords#other-authenticator-apps
^ v
| |
| | Which links to the quick start page:
| | https://www.twilio.com/docs/authy/twilioauth-sdk/quickstart
| |
<----- Which has a link about TOTP, which takes you back to the beginning
I see that the native mobile SDK's can generate a TOTP token:
https://www.twilio.com/docs/authy/twilioauth-sdk/quick-reference#time-based-one-time-passwords-totp
but I want to generate a token on a laptop (or cloud function or just someplace). The Authy Desktop client is doing it, so I know there must be a way. But I don't know what has been publicly exposed.
This question is relevant: how to get Google or Authy OTP by API
but the only answer depends on twilio calls and texts still: how to get Google or Authy OTP by API so that would be prohibitively expensive
twilio one-time-password authy totp
edited Nov 20 '18 at 1:13
Steve Vinoski
16.3k32133
asked Nov 19 '18 at 22:38
Joseph FraleyJoseph Fraley
11
add a comment |
Goal
I have a backend service that talks to AWS, and an automated tool that acquires AWS creds. The cred-getter has MFA enabled (not my choice), but I don't want to type in or copy a code. Instead, I want to write a bit of code that can programmatically generate or get a TOTP soft-token without texting or calling anyone. So today our workflow is like this:
call cred getter from cli => open authy app for totp code => paste into cli
but i want it to look like this:
call my custom cli => it makes a totp code and passes it to cred getter for me
Question
Is there a way to curl Authy or Twilio to get one of these soft tokens programmatically?
Existing Docs
There's sort of a circular maze of documentation that appears relevant to this question, but I can't break the circle.
-----> Twilio has a page describing TOTP:
| | https://www.twilio.com/authy/features/totp
| |
| | It links to a page describing OTP API access:
| | https://www.twilio.com/authy/api#softtoken
| |
| | That explains you can "build your own SDK-supported mobile authentication application.":
| | https://www.twilio.com/docs/authy/api/one-time-passwords#other-authenticator-apps
^ v
| |
| | Which links to the quick start page:
| | https://www.twilio.com/docs/authy/twilioauth-sdk/quickstart
| |
<----- Which has a link about TOTP, which takes you back to the beginning
I see that the native mobile SDK's can generate a TOTP token:
https://www.twilio.com/docs/authy/twilioauth-sdk/quick-reference#time-based-one-time-passwords-totp
but I want to generate a token on a laptop (or cloud function or just someplace). The Authy Desktop client is doing it, so I know there must be a way. But I don't know what has been publicly exposed.
This question is relevant: how to get Google or Authy OTP by API
but the only answer depends on twilio calls and texts still: how to get Google or Authy OTP by API so that would be prohibitively expensive
twilio one-time-password authy totp
edited Nov 20 '18 at 1:13
Steve Vinoski
16.3k32133
asked Nov 19 '18 at 22:38
Joseph FraleyJoseph Fraley
11
How did you connect the Authy app to your cred getter in the first place? Does the cred getter use the Authy API?
– philnash
Nov 20 '18 at 0:16
@philnash i dunno what it does, it's not my software. i think it uses okta under the hood, and individual users like me manually configure okta to use authy for 2fa codes using qr codes or some junk. do you think that's relevant? i figured i'd just write something to wrap the cred-getter and pass in codes from there w/o having to care
– Joseph Fraley
Nov 20 '18 at 0:50
add a comment |
Goal
I have a backend service that talks to AWS, and an automated tool that acquires AWS creds. The cred-getter has MFA enabled (not my choice), but I don't want to type in or copy a code. Instead, I want to write a bit of code that can programmatically generate or get a TOTP soft-token without texting or calling anyone. So today our workflow is like this:
call cred getter from cli => open authy app for totp code => paste into cli
but i want it to look like this:
call my custom cli => it makes a totp code and passes it to cred getter for me
Question
Is there a way to curl Authy or Twilio to get one of these soft tokens programmatically?
Existing Docs
There's sort of a circular maze of documentation that appears relevant to this question, but I can't break the circle.
-----> Twilio has a page describing TOTP:
| | https://www.twilio.com/authy/features/totp
| |
| | It links to a page describing OTP API access:
| | https://www.twilio.com/authy/api#softtoken
| |
| | That explains you can "build your own SDK-supported mobile authentication application.":
| | https://www.twilio.com/docs/authy/api/one-time-passwords#other-authenticator-apps
^ v
| |
| | Which links to the quick start page:
| | https://www.twilio.com/docs/authy/twilioauth-sdk/quickstart
| |
<----- Which has a link about TOTP, which takes you back to the beginning
I see that the native mobile SDK's can generate a TOTP token:
https://www.twilio.com/docs/authy/twilioauth-sdk/quick-reference#time-based-one-time-passwords-totp
but I want to generate a token on a laptop (or cloud function or just someplace). The Authy Desktop client is doing it, so I know there must be a way. But I don't know what has been publicly exposed.
This question is relevant: how to get Google or Authy OTP by API
but the only answer depends on twilio calls and texts still: how to get Google or Authy OTP by API so that would be prohibitively expensive
twilio one-time-password authy totp
edited Nov 20 '18 at 1:13
Steve Vinoski
16.3k32133
asked Nov 19 '18 at 22:38
Joseph FraleyJoseph Fraley
11
Goal
I have a backend service that talks to AWS, and an automated tool that acquires AWS creds. The cred-getter has MFA enabled (not my choice), but I don't want to type in or copy a code. Instead, I want to write a bit of code that can programmatically generate or get a TOTP soft-token without texting or calling anyone. So today our workflow is like this:
call cred getter from cli => open authy app for totp code => paste into cli
but i want it to look like this:
call my custom cli => it makes a totp code and passes it to cred getter for me
Question
Is there a way to curl Authy or Twilio to get one of these soft tokens programmatically?
Existing Docs
There's sort of a circular maze of documentation that appears relevant to this question, but I can't break the circle.
-----> Twilio has a page describing TOTP:
| | https://www.twilio.com/authy/features/totp
| |
| | It links to a page describing OTP API access:
| | https://www.twilio.com/authy/api#softtoken
| |
| | That explains you can "build your own SDK-supported mobile authentication application.":
| | https://www.twilio.com/docs/authy/api/one-time-passwords#other-authenticator-apps
^ v
| |
| | Which links to the quick start page:
| | https://www.twilio.com/docs/authy/twilioauth-sdk/quickstart
| |
<----- Which has a link about TOTP, which takes you back to the beginning
I see that the native mobile SDK's can generate a TOTP token:
https://www.twilio.com/docs/authy/twilioauth-sdk/quick-reference#time-based-one-time-passwords-totp
but I want to generate a token on a laptop (or cloud function or just someplace). The Authy Desktop client is doing it, so I know there must be a way. But I don't know what has been publicly exposed.
This question is relevant: how to get Google or Authy OTP by API
but the only answer depends on twilio calls and texts still: how to get Google or Authy OTP by API so that would be prohibitively expensive
twilio one-time-password authy totp
twilio one-time-password authy totp
edited Nov 20 '18 at 1:13
Steve Vinoski
16.3k32133
asked Nov 19 '18 at 22:38
Joseph FraleyJoseph Fraley
11
edited Nov 20 '18 at 1:13
Steve Vinoski
16.3k32133
asked Nov 19 '18 at 22:38
Joseph FraleyJoseph Fraley
11
edited Nov 20 '18 at 1:13
Steve Vinoski
16.3k32133
edited Nov 20 '18 at 1:13
Steve Vinoski
16.3k32133
edited Nov 20 '18 at 1:13
Steve Vinoski
16.3k32133
16.3k32133
asked Nov 19 '18 at 22:38
Joseph FraleyJoseph Fraley
11
asked Nov 19 '18 at 22:38
Joseph FraleyJoseph Fraley
11
asked Nov 19 '18 at 22:38
Joseph FraleyJoseph Fraley
11
11
How did you connect the Authy app to your cred getter in the first place? Does the cred getter use the Authy API?
– philnash
Nov 20 '18 at 0:16
@philnash i dunno what it does, it's not my software. i think it uses okta under the hood, and individual users like me manually configure okta to use authy for 2fa codes using qr codes or some junk. do you think that's relevant? i figured i'd just write something to wrap the cred-getter and pass in codes from there w/o having to care
– Joseph Fraley
Nov 20 '18 at 0:50
add a comment |
How did you connect the Authy app to your cred getter in the first place? Does the cred getter use the Authy API?
– philnash
Nov 20 '18 at 0:16
@philnash i dunno what it does, it's not my software. i think it uses okta under the hood, and individual users like me manually configure okta to use authy for 2fa codes using qr codes or some junk. do you think that's relevant? i figured i'd just write something to wrap the cred-getter and pass in codes from there w/o having to care
– Joseph Fraley
Nov 20 '18 at 0:50
How did you connect the Authy app to your cred getter in the first place? Does the cred getter use the Authy API?
– philnash
Nov 20 '18 at 0:16
How did you connect the Authy app to your cred getter in the first place? Does the cred getter use the Authy API?
– philnash
Nov 20 '18 at 0:16
@philnash i dunno what it does, it's not my software. i think it uses okta under the hood, and individual users like me manually configure okta to use authy for 2fa codes using qr codes or some junk. do you think that's relevant? i figured i'd just write something to wrap the cred-getter and pass in codes from there w/o having to care
– Joseph Fraley
Nov 20 '18 at 0:50
@philnash i dunno what it does, it's not my software. i think it uses okta under the hood, and individual users like me manually configure okta to use authy for 2fa codes using qr codes or some junk. do you think that's relevant? i figured i'd just write something to wrap the cred-getter and pass in codes from there w/o having to care
– Joseph Fraley
Nov 20 '18 at 0:50
add a comment |
1 Answer
1
active
oldest
votes
Twilio developer evangelist here.
From what you've said, your credential getter provides you a QR code with which you then configure Authy to generate OTP codes.
The QR code encodes a URL in the following format:
otpauth://TYPE/LABEL?PARAMETERS
For example:
otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example
The type is likely "totp", like the example, the label will refer to the app you're authenticating with. The important part is the secret in the parameters. The secret is a base 32 encoded key that you can use to generate TOTP codes using the TOTP algorithm. There is likely an implementation of the algorithm in you preferred language.
Find the secret and you can generate your codes.
answered Nov 20 '18 at 2:26
philnashphilnash
37.3k93353
so there's no way to just "ask" authy for the codes its already been configured to generate, without having authy call or text me?
– Joseph Fraley
Nov 21 '18 at 5:52
If Authy is calling or texting you then no, that is dealt with via the API. If you connected the Authy app using a QR code, then you can't ask Authy for the code but you can follow my answer above to generate it yourself.
– philnash
Nov 21 '18 at 5:55
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53383665%2fis-it-possible-to-generate-a-twilio-onecode-totp-token-programmatically%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Twilio developer evangelist here.
From what you've said, your credential getter provides you a QR code with which you then configure Authy to generate OTP codes.
The QR code encodes a URL in the following format:
otpauth://TYPE/LABEL?PARAMETERS
For example:
otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example
The type is likely "totp", like the example, the label will refer to the app you're authenticating with. The important part is the secret in the parameters. The secret is a base 32 encoded key that you can use to generate TOTP codes using the TOTP algorithm. There is likely an implementation of the algorithm in you preferred language.
Find the secret and you can generate your codes.
answered Nov 20 '18 at 2:26
philnashphilnash
37.3k93353
so there's no way to just "ask" authy for the codes its already been configured to generate, without having authy call or text me?
– Joseph Fraley
Nov 21 '18 at 5:52
If Authy is calling or texting you then no, that is dealt with via the API. If you connected the Authy app using a QR code, then you can't ask Authy for the code but you can follow my answer above to generate it yourself.
– philnash
Nov 21 '18 at 5:55
add a comment |
Twilio developer evangelist here.
From what you've said, your credential getter provides you a QR code with which you then configure Authy to generate OTP codes.
The QR code encodes a URL in the following format:
otpauth://TYPE/LABEL?PARAMETERS
For example:
otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example
The type is likely "totp", like the example, the label will refer to the app you're authenticating with. The important part is the secret in the parameters. The secret is a base 32 encoded key that you can use to generate TOTP codes using the TOTP algorithm. There is likely an implementation of the algorithm in you preferred language.
Find the secret and you can generate your codes.
answered Nov 20 '18 at 2:26
philnashphilnash
37.3k93353
so there's no way to just "ask" authy for the codes its already been configured to generate, without having authy call or text me?
– Joseph Fraley
Nov 21 '18 at 5:52
If Authy is calling or texting you then no, that is dealt with via the API. If you connected the Authy app using a QR code, then you can't ask Authy for the code but you can follow my answer above to generate it yourself.
– philnash
Nov 21 '18 at 5:55
add a comment |
Twilio developer evangelist here.
From what you've said, your credential getter provides you a QR code with which you then configure Authy to generate OTP codes.
The QR code encodes a URL in the following format:
otpauth://TYPE/LABEL?PARAMETERS
For example:
otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example
The type is likely "totp", like the example, the label will refer to the app you're authenticating with. The important part is the secret in the parameters. The secret is a base 32 encoded key that you can use to generate TOTP codes using the TOTP algorithm. There is likely an implementation of the algorithm in you preferred language.
Find the secret and you can generate your codes.
answered Nov 20 '18 at 2:26
philnashphilnash
37.3k93353
Twilio developer evangelist here.
From what you've said, your credential getter provides you a QR code with which you then configure Authy to generate OTP codes.
The QR code encodes a URL in the following format:
otpauth://TYPE/LABEL?PARAMETERS
For example:
otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example
The type is likely "totp", like the example, the label will refer to the app you're authenticating with. The important part is the secret in the parameters. The secret is a base 32 encoded key that you can use to generate TOTP codes using the TOTP algorithm. There is likely an implementation of the algorithm in you preferred language.
Find the secret and you can generate your codes.
answered Nov 20 '18 at 2:26
philnashphilnash
37.3k93353
answered Nov 20 '18 at 2:26
philnashphilnash
37.3k93353
answered Nov 20 '18 at 2:26
philnashphilnash
37.3k93353
answered Nov 20 '18 at 2:26
philnashphilnash
37.3k93353
37.3k93353
so there's no way to just "ask" authy for the codes its already been configured to generate, without having authy call or text me?
– Joseph Fraley
Nov 21 '18 at 5:52
If Authy is calling or texting you then no, that is dealt with via the API. If you connected the Authy app using a QR code, then you can't ask Authy for the code but you can follow my answer above to generate it yourself.
– philnash
Nov 21 '18 at 5:55
add a comment |
so there's no way to just "ask" authy for the codes its already been configured to generate, without having authy call or text me?
– Joseph Fraley
Nov 21 '18 at 5:52
If Authy is calling or texting you then no, that is dealt with via the API. If you connected the Authy app using a QR code, then you can't ask Authy for the code but you can follow my answer above to generate it yourself.
– philnash
Nov 21 '18 at 5:55
so there's no way to just "ask" authy for the codes its already been configured to generate, without having authy call or text me?
– Joseph Fraley
Nov 21 '18 at 5:52
so there's no way to just "ask" authy for the codes its already been configured to generate, without having authy call or text me?
– Joseph Fraley
Nov 21 '18 at 5:52
If Authy is calling or texting you then no, that is dealt with via the API. If you connected the Authy app using a QR code, then you can't ask Authy for the code but you can follow my answer above to generate it yourself.
– philnash
Nov 21 '18 at 5:55
If Authy is calling or texting you then no, that is dealt with via the API. If you connected the Authy app using a QR code, then you can't ask Authy for the code but you can follow my answer above to generate it yourself.
– philnash
Nov 21 '18 at 5:55
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53383665%2fis-it-possible-to-generate-a-twilio-onecode-totp-token-programmatically%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
How did you connect the Authy app to your cred getter in the first place? Does the cred getter use the Authy API?
– philnash
Nov 20 '18 at 0:16
@philnash i dunno what it does, it's not my software. i think it uses okta under the hood, and individual users like me manually configure okta to use authy for 2fa codes using qr codes or some junk. do you think that's relevant? i figured i'd just write something to wrap the cred-getter and pass in codes from there w/o having to care
– Joseph Fraley
Nov 20 '18 at 0:50