# Turn Your Terminal Into an Authenticator App

![banner](https://articles.aux4.blog/data/posts/aux4/turn-your-terminal-into-an-authenticator-app/banner.png)

## Introduction

Two-factor codes always arrive at the worst moment: you're in the terminal and the code is on your phone across the room. `aux4/otp` is a local TOTP manager — import your `otpauth://` secret once and it generates the same six-digit codes your authenticator app would, right where you're already working. This post imports a secret, generates and verifies codes, and exports one back as a QR.

## Install the package

```bash
aux4 aux4 pkger install aux4/otp
```

## Step 1: import a secret

When a service shows you a 2FA QR code, it encodes an `otpauth://` URL. Import that URL and `aux4/otp` stores it. We'll use a demo secret and keep it in a local `otp.json`:

```bash
aux4 otp import "otpauth://totp/Demo:sally@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Demo" --file ./otp.json
```

List what's stored — the name comes from the URL's label (`issuer:account`):

```bash
aux4 otp list --file ./otp.json
```

```text
  - Demo:sally@example.com
```

## Step 2: generate a code

`otp generate` prints the current six-digit code (and copies it to your clipboard — pass `--noCopy true` to skip that):

```bash
aux4 otp generate "Demo:sally@example.com" --file ./otp.json
```

```text
163705
```

TOTP codes are time-based: this one is valid for the current 30-second window and then changes, exactly like the code on your phone. That's the whole point — the same secret produces the same code your authenticator would show at that moment.

## Step 3: verify a code

`otp verify` checks a code against the stored secret. Because codes rotate, generate one and verify it in the same breath:

```bash
CODE=$(aux4 otp generate "Demo:sally@example.com" --noCopy true --file ./otp.json 2>/dev/null)
aux4 otp verify --name "Demo:sally@example.com" --code "$CODE" --file ./otp.json
```

```text
true
```

A valid code prints `true` and exits `0`; a wrong one is rejected:

```bash
aux4 otp verify --name "Demo:sally@example.com" --code 000000 --file ./otp.json
```

```text
false
invalid OTP
```

That `true`/`false` with a matching exit code is what makes it scriptable — you can gate an automated login on a real TOTP check instead of a human squinting at a phone.

## Step 4: export it back as a QR code

Need to enroll the same secret on another device? Render it as a scannable QR right in the terminal:

```bash
aux4 otp qrcode "Demo:sally@example.com" --file ./otp.json
```

```text
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
█ ▄▄▄▄▄ █▄▀▀▄▄▀▀▄█▄█▀██████ ▄▄▄▄▄ █
█ █   █ ███▄█ ▄█▄▄▀ ▄  ▄█▀█ █   █ █
█ █▄▄▄█ ██▄▀▄▀██▄▄▀█▄█▄▀▀▀█ █▄▄▄█ █
█▄▄▄▄▄▄▄█ █ ▀▄▀ ▀▄█▄█ █ █ █▄▄▄▄▄▄▄█
```

Or get the raw `otpauth://` URL back with `aux4 otp url "Demo:sally@example.com" --file ./otp.json`.

## Conclusion

`aux4/otp` puts your authenticator in the terminal: import a secret once, then `generate` codes and `verify` them without reaching for your phone — and because it's just commands, you can script the check into an automated flow. Keep the store file somewhere safe (it holds the secret), and your 2FA lives where you work.

## See Also

- [aux4/otp](https://hub.aux4.io/r/public/packages/aux4/otp)