skarbiec totp set

Invocation#

printf '%s' '<seed or otpauth:// address>' | skarbiec totp set <item-id>

Purpose#

Store an account's authenticator seed straight from what its provider shows when two-factor sign-in is enabled — the Base32 secret or the otpauth:// address inside the QR code — without rewriting the whole item through set.

Required inputs and options#

• One positional, the login or identity id, and the seed on standard input, never in an argument. Spaces in a secret are dropped and letters uppercased. An otpauth://totp/ address gives its secret parameter; when it states algorithm, digits or period they must be SHA1, six and thirty seconds, the ones every reader computes with.

Output and state effects#

• Computes the current code from the seed first, then stores it as totp_secret in a new revision with the same recipients and tags, appends a totp-seed-set journal record naming the item and revision, and prints ok, item, revision and current_code, the code to compare with the provider or the authenticator app now. The seed is never printed. totp seed and totp code's repair advice name this command. POST /v1/operator/items/totp-set takes id and seed; Desktop's item inspector offers it as Set up authenticator.

Refusals#

• A missing id exits 2 with the usage. Refuses empty input, an address that is not otpauth://totp/, one with no parameters or no secret, a parameter stated twice, another algorithm, digit count or period naming what was asked and what codes here use, a value that is not Base32, a seed that computes no code, an item whose kind has no totp_secret field, and an item a lifecycle controls; nothing is stored on any refusal.