{"openapi":"3.1.0","info":{"title":"One-Time Passwords","version":"0.1.0","description":"HOTP (RFC 4226) and TOTP (RFC 6238) one-time passwords — generate counter- and time-based codes, verify a code within a drift window, and build otpauth:// provisioning URIs.","x-guidance":"HOTP (RFC 4226) and TOTP (RFC 6238) one-time passwords — generate counter- and time-based codes, verify a code within a drift window, and build otpauth:// provisioning URIs. Each operation is an HTTP POST to its /v1/<operation> path with a JSON request body (see each operation's requestBody schema) and returns a JSON response. Endpoints are paid per successful call via x402 or MPP (USDC on Base); an unpaid request returns 402 with payment metadata in the WWW-Authenticate header.","contact":{"email":"hello@openverbs.com"}},"x-discovery":{"ownershipProofs":["0xb1401a71756f51464a9962db12f1eb3e9522490cd20010b06d00cf7b7770acfd5f79721f9dfdf2643f8cecd29af3bde9ec133941a386042b32d9886053a70de61b","0xc1c1f11793e18a00fcb7072421f26e89fb75b6aa517fa84370564991f4b10efa024f6f57e4e67eefd20cf46cc01fc5a62d793fa8fbcda04f26c946a3433d73f91b","0x676b474af0ef9ed4809b5d12d2e789b36e52d56215b21f601d71f76620e36ec630347116a7b2b349a3c3681e5db0fbfa76c4169a676b6d6f27864d0e5017284a1c","0xc2ab96522515ed9e9bc4f1a241b774bd48df42e951ddbf7f6aa8fc76f5a96a20421703e1ec402ce7eb1e4eabea3b6e4e4129cf39d56ea91cf4fcf38561fc94fc1c"]},"servers":[{"url":"https://otp.openverbs.com"}],"paths":{"/health":{"get":{"summary":"Health check","security":[],"responses":{"200":{"description":"Healthy","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean"},"service":{"type":"string"},"version":{"type":"string"}}}}}}}}},"/v1/totp":{"post":{"summary":"TOTP (time-based)","description":"Generate an RFC 6238 time-based one-time password from a base32 secret. Uses the current time by default, or an explicit unix timestamp (seconds); configurable period (default 30s), digits (default 6) and algorithm (default SHA1). Also returns the counter and seconds remaining in the window. Paid endpoint (x402 + MPP). Price: $0.004000 USDC per successful payment.","tags":["totp api","generate totp","time based otp","authenticator code","rfc 6238 code","one time password"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"secret":{"type":"string","minLength":1,"maxLength":1024,"description":"Base32-encoded shared secret."},"timestamp":{"type":"integer","minimum":0,"description":"Unix time in seconds. Default: now."},"period":{"type":"integer","minimum":1,"maximum":86400,"description":"Time step in seconds. Default 30."},"digits":{"type":"integer","minimum":6,"maximum":10,"description":"Number of code digits. Default 6."},"algorithm":{"type":"string","enum":["SHA1","SHA256","SHA512"],"description":"HMAC algorithm. Default SHA1."},"t0":{"type":"integer","minimum":0,"description":"Epoch start offset in seconds. Default 0."}},"required":["secret"],"additionalProperties":false}}}},"responses":{"200":{"description":"`{ code, counter, period, secondsRemaining }`.","content":{"application/json":{"schema":{"type":"object","description":"`{ code, counter, period, secondsRemaining }`."}}}},"400":{"description":"Invalid request; no payment is attempted"},"402":{"description":"Payment required; x402/MPP metadata returned in headers"},"502":{"description":"Upstream provider error after payment verification"}},"x-payment-info":{"amount":"4000","currency":"0x20c000000000000000000000b9537d11c60e8b50","description":"Generate an RFC 6238 time-based one-time password from a base32 secret. Uses the current time by default, or an explicit unix timestamp (seconds); configurable period (default 30s), digits (default 6) and algorithm (default SHA1). Also returns the counter and seconds remaining in the window.","method":"tempo","preferredOffer":"mpp-tempo","price":{"mode":"fixed","currency":"USD","amount":"0.004000"},"protocols":[{"x402":{"scheme":"exact","network":"eip155:8453","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}},{"mpp":{"method":"evm","intent":"charge","network":"8453","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}},{"mpp":{"method":"tempo","intent":"charge","network":"4217","currency":"0x20c000000000000000000000b9537d11c60e8b50","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}}],"network":"4217","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A","offers":[{"amount":"4000","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","description":"Generate an RFC 6238 time-based one-time password from a base32 secret. Uses the current time by default, or an explicit unix timestamp (seconds); configurable period (default 30s), digits (default 6) and algorithm (default SHA1). Also returns the counter and seconds remaining in the window.","intent":"charge","method":"evm","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"},{"amount":"4000","currency":"0x20c000000000000000000000b9537d11c60e8b50","description":"Generate an RFC 6238 time-based one-time password from a base32 secret. Uses the current time by default, or an explicit unix timestamp (seconds); configurable period (default 30s), digits (default 6) and algorithm (default SHA1). Also returns the counter and seconds remaining in the window.","intent":"charge","method":"tempo","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}]}}},"/v1/hotp":{"post":{"summary":"HOTP (counter-based)","description":"Generate an RFC 4226 counter-based HMAC one-time password from a base32 secret and counter. Configurable digits (6–10, default 6) and algorithm (SHA1/SHA256/SHA512, default SHA1). An invalid base32 secret is a clean 400. Paid endpoint (x402 + MPP). Price: $0.004000 USDC per successful payment.","tags":["hotp api","generate hotp","counter based otp","hmac one time password","rfc 4226 code","otp counter code"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"secret":{"type":"string","minLength":1,"maxLength":1024,"description":"Base32-encoded shared secret."},"counter":{"type":"integer","minimum":0,"description":"The HOTP counter value."},"digits":{"type":"integer","minimum":6,"maximum":10,"description":"Number of code digits. Default 6."},"algorithm":{"type":"string","enum":["SHA1","SHA256","SHA512"],"description":"HMAC algorithm. Default SHA1."}},"required":["secret","counter"],"additionalProperties":false}}}},"responses":{"200":{"description":"`{ code, counter }`.","content":{"application/json":{"schema":{"type":"object","description":"`{ code, counter }`."}}}},"400":{"description":"Invalid request; no payment is attempted"},"402":{"description":"Payment required; x402/MPP metadata returned in headers"},"502":{"description":"Upstream provider error after payment verification"}},"x-payment-info":{"amount":"4000","currency":"0x20c000000000000000000000b9537d11c60e8b50","description":"Generate an RFC 4226 counter-based HMAC one-time password from a base32 secret and counter. Configurable digits (6–10, default 6) and algorithm (SHA1/SHA256/SHA512, default SHA1). An invalid base32 secret is a clean 400.","method":"tempo","preferredOffer":"mpp-tempo","price":{"mode":"fixed","currency":"USD","amount":"0.004000"},"protocols":[{"x402":{"scheme":"exact","network":"eip155:8453","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}},{"mpp":{"method":"evm","intent":"charge","network":"8453","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}},{"mpp":{"method":"tempo","intent":"charge","network":"4217","currency":"0x20c000000000000000000000b9537d11c60e8b50","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}}],"network":"4217","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A","offers":[{"amount":"4000","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","description":"Generate an RFC 4226 counter-based HMAC one-time password from a base32 secret and counter. Configurable digits (6–10, default 6) and algorithm (SHA1/SHA256/SHA512, default SHA1). An invalid base32 secret is a clean 400.","intent":"charge","method":"evm","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"},{"amount":"4000","currency":"0x20c000000000000000000000b9537d11c60e8b50","description":"Generate an RFC 4226 counter-based HMAC one-time password from a base32 secret and counter. Configurable digits (6–10, default 6) and algorithm (SHA1/SHA256/SHA512, default SHA1). An invalid base32 secret is a clean 400.","intent":"charge","method":"tempo","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}]}}},"/v1/verify":{"post":{"summary":"Verify a TOTP code","description":"Verify a submitted TOTP code against a base32 secret, scanning ±window time steps (default ±1) to tolerate clock drift. Returns valid plus the matching step offset (delta). A code that does not match is a successful result with valid=false — not an error. Paid endpoint (x402 + MPP). Price: $0.004000 USDC per successful payment.","tags":["verify totp","validate otp code","check authenticator code","totp verification api","mfa code validation","otp drift window"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"secret":{"type":"string","minLength":1,"maxLength":1024,"description":"Base32-encoded shared secret."},"code":{"type":"string","minLength":1,"maxLength":12,"description":"The submitted OTP code."},"timestamp":{"type":"integer","minimum":0,"description":"Unix time in seconds. Default: now."},"period":{"type":"integer","minimum":1,"maximum":86400,"description":"Time step in seconds. Default 30."},"digits":{"type":"integer","minimum":6,"maximum":10,"description":"Number of code digits. Default 6."},"algorithm":{"type":"string","enum":["SHA1","SHA256","SHA512"],"description":"HMAC algorithm. Default SHA1."},"window":{"type":"integer","minimum":0,"maximum":20,"description":"Steps of drift tolerance each side. Default 1."},"t0":{"type":"integer","minimum":0,"description":"Epoch start offset in seconds. Default 0."}},"required":["secret","code"],"additionalProperties":false}}}},"responses":{"200":{"description":"`{ valid, delta }`.","content":{"application/json":{"schema":{"type":"object","description":"`{ valid, delta }`."}}}},"400":{"description":"Invalid request; no payment is attempted"},"402":{"description":"Payment required; x402/MPP metadata returned in headers"},"502":{"description":"Upstream provider error after payment verification"}},"x-payment-info":{"amount":"4000","currency":"0x20c000000000000000000000b9537d11c60e8b50","description":"Verify a submitted TOTP code against a base32 secret, scanning ±window time steps (default ±1) to tolerate clock drift. Returns valid plus the matching step offset (delta). A code that does not match is a successful result with valid=false — not an error.","method":"tempo","preferredOffer":"mpp-tempo","price":{"mode":"fixed","currency":"USD","amount":"0.004000"},"protocols":[{"x402":{"scheme":"exact","network":"eip155:8453","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}},{"mpp":{"method":"evm","intent":"charge","network":"8453","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}},{"mpp":{"method":"tempo","intent":"charge","network":"4217","currency":"0x20c000000000000000000000b9537d11c60e8b50","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}}],"network":"4217","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A","offers":[{"amount":"4000","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","description":"Verify a submitted TOTP code against a base32 secret, scanning ±window time steps (default ±1) to tolerate clock drift. Returns valid plus the matching step offset (delta). A code that does not match is a successful result with valid=false — not an error.","intent":"charge","method":"evm","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"},{"amount":"4000","currency":"0x20c000000000000000000000b9537d11c60e8b50","description":"Verify a submitted TOTP code against a base32 secret, scanning ±window time steps (default ±1) to tolerate clock drift. Returns valid plus the matching step offset (delta). A code that does not match is a successful result with valid=false — not an error.","intent":"charge","method":"tempo","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}]}}},"/v1/uri":{"post":{"summary":"Build otpauth:// URI","description":"Build an otpauth:// provisioning URI (the string encoded in authenticator QR codes) for a totp or hotp secret. Includes label, issuer, algorithm, digits and period (totp) or counter (hotp). The secret must be valid base32. Paid endpoint (x402 + MPP). Price: $0.004000 USDC per successful payment.","tags":["otpauth uri","generate qr provisioning uri","authenticator setup uri","build otpauth link","totp provisioning","hotp provisioning"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"type":{"type":"string","enum":["totp","hotp"],"description":"OTP type. Default totp."},"label":{"type":"string","minLength":1,"maxLength":128,"description":"Account label, e.g. 'Example:alice@example.com'."},"secret":{"type":"string","minLength":1,"maxLength":1024,"description":"Base32-encoded shared secret."},"issuer":{"type":"string","minLength":1,"maxLength":128,"description":"Issuer/provider name."},"algorithm":{"type":"string","enum":["SHA1","SHA256","SHA512"],"description":"HMAC algorithm. Default SHA1."},"digits":{"type":"integer","minimum":6,"maximum":10,"description":"Number of code digits. Default 6."},"period":{"type":"integer","minimum":1,"maximum":86400,"description":"Time step (totp only). Default 30."},"counter":{"type":"integer","minimum":0,"description":"Initial counter (required for hotp)."}},"required":["label","secret"],"additionalProperties":false}}}},"responses":{"200":{"description":"`{ uri }`.","content":{"application/json":{"schema":{"type":"object","description":"`{ uri }`."}}}},"400":{"description":"Invalid request; no payment is attempted"},"402":{"description":"Payment required; x402/MPP metadata returned in headers"},"502":{"description":"Upstream provider error after payment verification"}},"x-payment-info":{"amount":"4000","currency":"0x20c000000000000000000000b9537d11c60e8b50","description":"Build an otpauth:// provisioning URI (the string encoded in authenticator QR codes) for a totp or hotp secret. Includes label, issuer, algorithm, digits and period (totp) or counter (hotp). The secret must be valid base32.","method":"tempo","preferredOffer":"mpp-tempo","price":{"mode":"fixed","currency":"USD","amount":"0.004000"},"protocols":[{"x402":{"scheme":"exact","network":"eip155:8453","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}},{"mpp":{"method":"evm","intent":"charge","network":"8453","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}},{"mpp":{"method":"tempo","intent":"charge","network":"4217","currency":"0x20c000000000000000000000b9537d11c60e8b50","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}}],"network":"4217","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A","offers":[{"amount":"4000","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","description":"Build an otpauth:// provisioning URI (the string encoded in authenticator QR codes) for a totp or hotp secret. Includes label, issuer, algorithm, digits and period (totp) or counter (hotp). The secret must be valid base32.","intent":"charge","method":"evm","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"},{"amount":"4000","currency":"0x20c000000000000000000000b9537d11c60e8b50","description":"Build an otpauth:// provisioning URI (the string encoded in authenticator QR codes) for a totp or hotp secret. Includes label, issuer, algorithm, digits and period (totp) or counter (hotp). The secret must be valid base32.","intent":"charge","method":"tempo","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}]}}}},"x-service-info":{"categories":["compute"],"docs":{"homepage":"https://otp.openverbs.com","apiReference":"https://otp.openverbs.com/openapi.json"}}}