<!-- BusyBot node reference — https://busybot.net/tools/totp/ -->

> Node: TOTP (`totp`) · Action · v1
> Category: Core Nodes · Credentials: TOTP Secret (`totpApi`)
> Updated: 2026-08-16

# TOTP

> Generate TOTP codes for two-factor authentication

## Overview

The TOTP tool generates RFC 6238 time-based one-time passwords using the otpauth library. It creates a token from a shared secret (resolved from credentials), with configurable algorithm, digits, and period. The token is generated once and applied to all items, along with the remaining validity time in seconds.

**Category:** Core Nodes  
**Tool Name:** `totp`  
**Version:** 1

**Appearance:** Icon: `lucide-KeyRound` | Color: `#1a8e3f`

## Node Type

**Action** — processes input items and produces output

## Input / Output

| Direction | Port(s) |
|-----------|--------|
| Input | `Input` |
| Output | `Output`, `Error` |

## Credentials

This tool requires **TOTP Secret** credentials.
See the [Credentials Guide](https://busybot.net/credentials/totp-api/) for setup instructions.

### Parameters

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Algorithm | `options` | No | `SHA1` | The HMAC hashing algorithm to use. |
| | | | | Options: `SHA1`, `SHA224`, `SHA256`, `SHA3-224`, `SHA3-256`, `SHA3-384`, `SHA3-512`, `SHA384`, `SHA512` |
| Digits | `number` | No | `6` | Number of digits in the generated code. |
| Period | `number` | No | `30` | How long (in seconds) the code is valid. |
| Max Concurrency | `number` | No | `10` | Maximum number of items to process concurrently. |

## Output Data

One output item per input item. Two fields are added to the item JSON; the rest of the item passes through unchanged and binary data is forwarded.

```json
{
  "token": "492039",
  "secondsRemaining": 17
}
```

- `token` — the generated one-time password, as a string with as many digits as **Digits** specifies.
- `secondsRemaining` — how many seconds are left before the current **Period** rolls over and the code changes.

The code is generated **once per node run** and stamped onto every item, so all items in the same run carry the same `token` and the same `secondsRemaining`.

Reference the code downstream by expression, e.g. `{{ $json.token }}`.

## Usage Examples

- Generate a 6-digit TOTP code
- Create 2FA tokens for automated login

## Example Configuration

Generate a standard 6-digit code:

```json
{
  "type": "totp",
  "parameters": {
    "algorithm": "SHA1",
    "digits": 6,
    "period": 30,
    "maxConcurrency": 10
  }
}
```

Generate an 8-digit code on a 60-second period:

```json
{
  "type": "totp",
  "parameters": {
    "algorithm": "SHA256",
    "digits": 8,
    "period": 60
  }
}
```

### Error Handling

| Mode | Behavior |
|------|----------|
| **stop** | Halts workflow on first error |
| **continue** | Skips failed items, passes successful ones through |
| **errorPort** | Routes failed items to Error output port |

## Tips

Generates TOTP codes for 2FA using a shared secret from credentials.

### Behavior notes

- **Algorithm, Digits and Period must match the service.** A code generated with different settings from the ones the service registered is simply wrong; it does not error, it just fails to authenticate. Almost every service uses the defaults — `SHA1`, 6 digits, 30 seconds.
- **Use the code immediately.** `secondsRemaining` tells you how much of the window is left; a code handed to a slow downstream step can expire before it is submitted.
- **Whitespace in the secret is ignored** and lower-case secrets are accepted, so a base32 secret pasted straight out of a setup screen works as-is.