Skip to main content

Function: decryptTOTPSecret()

decryptTOTPSecret(secret, key?): string

Defined in: src/auth/shared.ts:600

Decrypts a TOTP shared secret previously encrypted by encryptTOTPSecret(). Anything lacking the enc:v1: envelope prefix is treated as legacy (or never-encrypted) plaintext and returned unchanged - this is what lets auth:totp:encryption_key be enabled without a forced migration of already-stored secrets.

Parameters​

secret​

string

The persisted TOTPSecret.secret value, encrypted or plaintext.

key?​

string

The 64-character hex encryption key (TOTPConfig.encryption_key) that encrypted it.

Returns​

string

Throws​

ApiError (500) if secret is encrypted but key is unset, or key is malformed.