skarbiec totp uri

Invocation#

skarbiec totp uri <item-id>

Purpose#

Move a second factor to a phone, or keep a second device enrolled, from the seed the vault already keeps — without asking the site for a new one.

Required inputs and options#

• Exactly one item id: a login or identity whose totp_secret holds a seed. POST /v1/operator/items/totp-uri takes id.

Output and state effects#

• Opens the item with the owner's key and prints ok, item, issuer (the item's name, else the first site it signs in to, else its id), account (its username, else its id) and uri: otpauth://totp/<issuer>:<account>?secret=…&issuer=…&algorithm=SHA1&digits=6&period=30 in the Key URI Format (https://github.com/google/google-authenticator/wiki/Key-Uri-Format), with every part percent-encoded and the parameters this vault computes codes with, so the phone answers the codes `totp code` answers. It appends a totp-uri-read journal record naming the item, never the seed. The address holds the seed: treat the output as the secret itself. Desktop's item inspector shows it as Show the authenticator QR code, after Touch ID when that setting is on.

Refusals#

• Anything but one id exits 2 with `usage: totp uri <item-id>`. An item that does not exist or will not open fails with its own error, and one with no seed with `<id> keeps no authenticator seed, so there is no address to move; `skarbiec totp set <id>` stores one from the site's QR code`.