OMKEY TOOLS

Two-factor sign-in code API (2FA).

Use this API to create or check short-lived sign-in codes as an extra layer beyond a password. No developer account or API key is needed.

Plain-language guide to the terms

Two-factor authentication (2FA): Sign-in requires two different proofs, for example your password and a temporary code.
One-time password (OTP): A short code that can be used to confirm a sign-in or action.
TOTP: A code that changes automatically with time, usually every 30 seconds. Authenticator apps commonly use this method.
HOTP: A code that changes when the next code is requested, using a counter instead of a clock.
Authenticator app: An app on your phone or computer that creates temporary sign-in codes.
Secret key: A private setup value shared between your account and authenticator app. Anyone who gets it may create matching codes.
API: A way for one application to ask another application to perform a task.
OpenAPI: A standard document that describes API addresses, inputs and responses.

Endpoints

POST /api/v1/2fa/secret/generate
POST /api/v1/2fa/totp/generate
POST /api/v1/2fa/totp/verify
POST /api/v1/2fa/hotp/generate
POST /api/v1/2fa/hotp/verify
POST /api/v1/2fa/uri/build
POST /api/v1/2fa/uri/parse
POST /api/v1/2fa/qr

Send JSON over HTTPS from your application’s server-side code; do not send account passwords. Each request is limited to 4 KB, with 30 requests per minute per network address and 300 per minute overall. Browser calls from other websites are blocked. Errors include a readable code and message. OpenAPI 3.1 document.

Integration example

$response = file_get_contents('https://omkey.top/api/v1/2fa/totp/verify', false, stream_context_create(['http' => ['method' => 'POST', 'header' => "Content-Type: application/json\r\n", 'content' => json_encode(['secret' => $secret, 'code' => $code]), 'ignore_errors' => true]]));
$result = json_decode($response, true);
if ($result['data']['matches']) {
    // Atomically reject an already-used matchedStep before authenticating.
}

Security and privacy

The secret key and code are sent to Omkey over HTTPS for calculation. They are not saved as verification history. Use the service only if this data flow fits your privacy requirements. Verification is stateless: your application must atomically prevent TOTP replay or advance the HOTP counter after success. The API does not authenticate users, create accounts, or make login decisions. Prefer local computation for production authentication.

The qr endpoint returns the otpauth URI payload, not a raster image. Generate the QR image in your own application.