Turn Your Terminal Into an Authenticator App

Introduction

Two-factor codes always arrive at the worst moment: you're in the terminal and the code is on your phone across the room. aux4/otp is a local TOTP manager — import your otpauth:// secret once and it generates the same six-digit codes your authenticator app would, right where you're already working. This post imports a secret, generates and verifies codes, and exports one back as a QR.

Install the package

aux4 aux4 pkger install aux4/otp

Step 1: import a secret

When a service shows you a 2FA QR code, it encodes an otpauth:// URL. Import that URL and aux4/otp stores it. We'll use a demo secret and keep it in a local otp.json:

aux4 otp import "otpauth://totp/Demo:sally@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Demo" --file ./otp.json

List what's stored — the name comes from the URL's label (issuer:account):

aux4 otp list --file ./otp.json

  - Demo:sally@example.com

Step 2: generate a code

otp generate prints the current six-digit code (and copies it to your clipboard — pass --noCopy true to skip that):

aux4 otp generate "Demo:sally@example.com" --file ./otp.json

TOTP codes are time-based: this one is valid for the current 30-second window and then changes, exactly like the code on your phone. That's the whole point — the same secret produces the same code your authenticator would show at that moment.

Step 3: verify a code

otp verify checks a code against the stored secret. Because codes rotate, generate one and verify it in the same breath:

CODE=$(aux4 otp generate "Demo:sally@example.com" --noCopy true --file ./otp.json 2>/dev/null)
aux4 otp verify --name "Demo:sally@example.com" --code "$CODE" --file ./otp.json

true

A valid code prints true and exits 0; a wrong one is rejected:

aux4 otp verify --name "Demo:sally@example.com" --code 000000 --file ./otp.json

false
invalid OTP

That true/false with a matching exit code is what makes it scriptable — you can gate an automated login on a real TOTP check instead of a human squinting at a phone.

Step 4: export it back as a QR code

Need to enroll the same secret on another device? Render it as a scannable QR right in the terminal:

aux4 otp qrcode "Demo:sally@example.com" --file ./otp.json

▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
█ ▄▄▄▄▄ █▄▀▀▄▄▀▀▄█▄█▀██████ ▄▄▄▄▄ █
█ █   █ ███▄█ ▄█▄▄▀ ▄  ▄█▀█ █   █ █
█ █▄▄▄█ ██▄▀▄▀██▄▄▀█▄█▄▀▀▀█ █▄▄▄█ █
█▄▄▄▄▄▄▄█ █ ▀▄▀ ▀▄█▄█ █ █ █▄▄▄▄▄▄▄█

Or get the raw otpauth:// URL back with aux4 otp url "Demo:sally@example.com" --file ./otp.json.

Conclusion

aux4/otp puts your authenticator in the terminal: import a secret once, then generate codes and verify them without reaching for your phone — and because it's just commands, you can script the check into an automated flow. Keep the store file somewhere safe (it holds the secret), and your 2FA lives where you work.