Developer API

2faco API

Generate TOTP codes, validate 2FA tokens, and create secrets programmatically. Free for non-commercial use with a self-service API key.

Get Your Free API Key

No account, no email, no questions asked. Click the button and get your key instantly.

Your API Key

Key active — use it immediately

Store this key securely. It will not be shown again.

Base URL

https://2faco.com/api/v1

Authentication

Include your API key in the Authorization header on every request except /health and /signup.

Authorization: Bearer <your-api-key>

Endpoints

POST /signup

Create a new API key. No authentication required.

Parameter	Type		Description
label	string	optional	Friendly name to identify the key owner

Example request

curl -X POST https://2faco.com/api/v1/signup \
  -H "Content-Type: application/json" \
  -d '{"label": "my-script"}'

Response

{
  "api_key": "2faco_0e25779c6dab43f390938beffe8812a3dffefb36feb68b1c",
  "label": "my-script",
  "message": "Store this key securely. It will not be shown again."
}

GET /health

Health check — no auth required.

Response

{"status": "ok", "service": "2faco-api"}

POST /totp

Generate a TOTP code from a secret key.

Parameter	Type		Description
secret	string	required	Base32-encoded secret key
digits	number	optional	Code length (default: 6)
period	number	optional	Time window in seconds (default: 30)
algorithm	string	optional	SHA1, SHA256, or SHA512 (default: SHA1)

Example

curl -X POST https://2faco.com/api/v1/totp \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"secret": "JBSWY3DPEHPK3PXP"}'

Response

{
  "code": "341595",
  "period": 30,
  "digits": 6,
  "algorithm": "SHA1",
  "expires_in": 12
}

POST /validate

Check if a TOTP code is valid for a given secret. Uses a window of ±1 interval.

Parameter	Type		Description
secret	string	required	Base32-encoded secret key
code	string	required	6-digit TOTP code to validate
window	number	optional	Intervals before/after current (default: 1)

Example

curl -X POST https://2faco.com/api/v1/validate \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"secret": "JBSWY3DPEHPK3PXP", "code": "341595"}'

Response

{"valid": true}

GET /generate-secret

Generate a cryptographically random Base32 secret key for TOTP setup.

Example

curl -X GET https://2faco.com/api/v1/generate-secret \
  -H "Authorization: Bearer <key>"

Response

{"secret": "4XR5VVSMUGBFFVH4CTMRSJK6VU6HLOPF"}

Rate Limits

Signup is limited to 3 requests per hour per IP address. Authenticated endpoints currently have no rate limit, but may be throttled if abused.

JavaScript Example

const API_KEY = "2faco_your_key_here";
const BASE = "https://2faco.com/api/v1";

async function getTOTP(secret) {
  const res = await fetch(`${BASE}/totp`, {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${API_KEY}`,
      "Content-Type": "application/json"
    },
    body: JSON.stringify({ secret })
  });
  return res.json();
}

getTOTP("JBSWY3DPEHPK3PXP").then(console.log);
// { code: "341595", period: 30, digits: 6, algorithm: "SHA1", expires_in: 12 }