Skip to main content

Interface: TOTPConfig

Defined in: src/auth/types.ts:128

Configuration for a TOTP (RFC 6238) issuer. Used both to generate the otpauth:// provisioning URI (the "Key URI Format" companion convention supported by virtually every TOTP authenticator app, e.g. Google Authenticator/Authy/1Password) for enrolling a new secret, and as the default token parameters for newly registered secrets.

Properties​

algorithm?​

optional algorithm?: TOTPAlgorithm

Defined in: src/auth/types.ts:139

The HMAC hash algorithm used to generate tokens. Default is "sha1" — the only algorithm universally supported by authenticator apps despite RFC 6238 permitting SHA-256/SHA-512.

digits?​

optional digits?: number

Defined in: src/auth/types.ts:132

The number of digits each generated token contains. Default is 6.

encryption_key?​

optional encryption_key?: string

Defined in: src/auth/types.ts:154

A 64-character hex string (32 bytes) used as the AES-256-GCM key to encrypt a TOTPSecret.secret before it's persisted. Unset (the default) leaves new/updated secrets stored as plaintext, exactly as before this option existed. Setting it only affects secrets created/updated from that point forward — an already-stored plaintext secret is detected automatically (it lacks the enc:v1: envelope prefix) and keeps verifying correctly with no migration step required. See encryptTOTPSecret()/decryptTOTPSecret() in shared.ts.

epochTolerance?​

optional epochTolerance?: number | number[]

Defined in: src/auth/types.ts:145

Specifies a tolerance window around the current time. It does not represent a strict duration in seconds (e.g., "±N seconds"), but rather dictates which periods overlap with the tolerance window [currentTime - tolerance, currentTime + tolerance]. Default value is [1, 0].

issuer​

issuer: string

Defined in: src/auth/types.ts:130

The human-readable name of the issuing service, shown to the user by the authenticator app.

period?​

optional period?: number

Defined in: src/auth/types.ts:134

The time step, in seconds, that each generated token remains valid for. Default is 30.