1

Goal

I have a backend service that talks to AWS, and an automated tool that acquires AWS creds. The cred-getter has MFA enabled (not my choice), but I don't want to type in or copy a code. Instead, I want to write a bit of code that can programmatically generate or get a TOTP soft-token without texting or calling anyone. So today our workflow is like this:

call cred getter from cli => open authy app for totp code => paste into cli

but i want it to look like this:

call my custom cli => it makes a totp code and passes it to cred getter for me

Question

Is there a way to curl Authy or Twilio to get one of these soft tokens programmatically?

Existing Docs

There's sort of a circular maze of documentation that appears relevant to this question, but I can't break the circle.

 ----->  Twilio has a page describing TOTP:
|      |   https://www.twilio.com/authy/features/totp
|      |
|      | It links to a page describing OTP API access:
|      |   https://www.twilio.com/authy/api#softtoken
|      |
|      | That explains you can "build your own SDK-supported mobile authentication application.":
|      |   https://www.twilio.com/docs/authy/api/one-time-passwords#other-authenticator-apps
^      v
|      |
|      | Which links to the quick start page:
|      |   https://www.twilio.com/docs/authy/twilioauth-sdk/quickstart 
|      |
 <-----  Which has a link about TOTP, which takes you back to the beginning

I see that the native mobile SDK's can generate a TOTP token: https://www.twilio.com/docs/authy/twilioauth-sdk/quick-reference#time-based-one-time-passwords-totp

but I want to generate a token on a laptop (or cloud function or just someplace). The Authy Desktop client is doing it, so I know there must be a way. But I don't know what has been publicly exposed.

This question is relevant: how to get Google or Authy OTP by API

but the only answer depends on twilio calls and texts still: how to get Google or Authy OTP by API so that would be prohibitively expensive

Steve Vinoski
  • 19,847
  • 3
  • 31
  • 46
Joseph Fraley
  • 51
  • 1
  • 4
  • How did you connect the Authy app to your cred getter in the first place? Does the cred getter use the Authy API? – philnash Nov 20 '18 at 00:16
  • @philnash i dunno what it does, it's not my software. i think it uses okta under the hood, and individual users like me manually configure okta to use authy for 2fa codes using qr codes or some junk. do you think that's relevant? i figured i'd just write something to wrap the cred-getter and pass in codes from there w/o having to care – Joseph Fraley Nov 20 '18 at 00:50

1 Answers1

0

Twilio developer evangelist here.

From what you've said, your credential getter provides you a QR code with which you then configure Authy to generate OTP codes.

The QR code encodes a URL in the following format:

otpauth://TYPE/LABEL?PARAMETERS

For example:

otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example

The type is likely "totp", like the example, the label will refer to the app you're authenticating with. The important part is the secret in the parameters. The secret is a base 32 encoded key that you can use to generate TOTP codes using the TOTP algorithm. There is likely an implementation of the algorithm in you preferred language.

Find the secret and you can generate your codes.

philnash
  • 70,667
  • 10
  • 60
  • 88
  • so there's no way to just "ask" authy for the codes its already been configured to generate, without having authy call or text me? – Joseph Fraley Nov 21 '18 at 05:52
  • If Authy is calling or texting you then no, that is dealt with via the API. If you connected the Authy app using a QR code, then you can't ask Authy for the code but you can follow my answer above to generate it yourself. – philnash Nov 21 '18 at 05:55