# TOTP / 2FA

Make or check two-factor one-time codes (TOTP).

## Do things in TOTP / 2FA

Add a **TOTP / 2FA** step and choose an **Operation**. Choose the row to see the fields of each.

- [Generate / Verify TOTP](https://docs.gorunner.io/apps/totp-2fa#fields-f-compute): Generate code · Verify code

Later steps read a step’s output by its name: see [Use data from earlier steps](https://docs.gorunner.io/build/use-data-from-earlier-steps).

Not in your list? See [When an app isn’t here](https://docs.gorunner.io/apps/when-an-app-isnt-here#q-not-in-list).

## For developers

In the API, which calls apps pieces, TOTP / 2FA is `pieceId: "totp"` with `actionId: "compute"`, set by `operation`. [Get an app](https://docs.gorunner.io/api/apps/get-app) returns every field.

It computes from its inputs only (`pure`). See [How versions and side effects work](https://docs.gorunner.io/apps#q-versions).

### TOTP / 2FA › Generate / Verify TOTP

Generate a TOTP code or verify a user-supplied code against the current window.

### Generate code

- **Secret · Required**: Base32-encoded shared secret (same value stored in your authenticator app).
- **Digits · Optional**: How many numbers the code has. Most apps use 6; pick 8 only if your setup requires it. Options: 6 digits (standard), 8 digits (extended). Default: 6 digits (standard).
- **Algorithm · Optional**: HMAC hashing algorithm. Leave on SHA1 unless your authenticator setup specifies otherwise: it must match whatever generated the secret. Options: SHA1 (standard), SHA224, SHA256, SHA384, SHA512, SHA3-224, SHA3-256, SHA3-384, SHA3-512. Default: SHA1 (standard).
- **Period (seconds) · Optional**: Time step in seconds (default 30 per RFC 6238). Default: 30.

### Verify code

- **Secret · Required**: Base32-encoded shared secret (same value stored in your authenticator app).
- **Code to Verify · Optional**: The TOTP code entered by the user.
- **Digits · Optional**: How many numbers the code has. Most apps use 6; pick 8 only if your setup requires it. Options: 6 digits (standard), 8 digits (extended). Default: 6 digits (standard).
- **Algorithm · Optional**: HMAC hashing algorithm. Leave on SHA1 unless your authenticator setup specifies otherwise: it must match whatever generated the secret. Options: SHA1 (standard), SHA224, SHA256, SHA384, SHA512, SHA3-224, SHA3-256, SHA3-384, SHA3-512. Default: SHA1 (standard).
- **Period (seconds) · Optional**: Time step in seconds (default 30 per RFC 6238). Default: 30.

Source: https://docs.gorunner.io/apps/totp-2fa