Skip to main content

Function: encryptTOTPSecret()

encryptTOTPSecret(secret, key?): string

Defined in: src/auth/shared.ts:576

Encrypts a TOTP shared secret for storage, using AES-256-GCM with a fresh random IV per call. Stores the result as "enc:v1:" + base64(iv[12] + authTag[16] + ciphertext). A no-op (returns secret unchanged) when key is unset, so leaving auth:totp:encryption_key unconfigured is exactly today's plaintext behavior.

Parameters

secret

string

The plaintext TOTP shared secret to encrypt.

key?

string

The 64-character hex encryption key (TOTPConfig.encryption_key). Omit to store as plaintext.

Returns

string