Skip to main content
If you store a TOTP secret in the vault, the agent can retrieve the current 6-digit authenticator code without ever seeing the raw secret. This lets you automate logins that require two-factor authentication — the vault handles the time-based math and returns only the code that is valid right now.

​
Get the current TOTP code

GET /api/v1/vault/:id/totp returns the current authenticator code for a credential stored with kind: totp. Requires vault:use. The equivalent MCP tool is get_totp_code.
Get a TOTP code

​
Response fields

​
string
The current 6-digit authenticator code.
​
string
ISO 8601 timestamp when this code expires and the next one becomes active.
​
number
The TOTP period in seconds (typically 30).
The raw TOTP secret is never returned by any endpoint after it is stored. Only the current code is accessible, and every call is recorded in the org’s audit history.

​
Store a TOTP secret

Store a TOTP secret when creating a credential by setting kind: totp and providing the base32-encoded secret in the secret field. You can also add a TOTP secret to an existing credential with PATCH /api/v1/vault/:id (or the update_credential MCP tool).

​
MCP tool

From a chat client, use the get_totp_code tool directly:
Use get_totp_code to automate portal logins that require 2FA. The agent retrieves the live code at the moment it’s needed — no raw secrets stored in code, no secrets visible in the chat transcript.