{"uid":"cap_jXuKMtEr6-biereID0usQ","slug":"totp-code-verifier-otp-openverbs-com-ce8b63e0","name":"TOTP Code Verifier (otp.openverbs.com)","description":"Verify a submitted TOTP code against a base32 secret, scanning ±window time steps (default ±1) to tolerate clock drift. Returns valid plus the matching step offset (delta). A code that does not match is a successful result with valid=false — not an error.","url":"https://otp.openverbs.com/v1/verify","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","required":["secret","code"],"properties":{"t0":{"type":"integer","minimum":0,"description":"Epoch start offset in seconds. Default 0."},"code":{"type":"string","maxLength":12,"minLength":1,"description":"The submitted OTP code."},"digits":{"type":"integer","maximum":10,"minimum":6,"description":"Number of code digits. Default 6."},"period":{"type":"integer","maximum":86400,"minimum":1,"description":"Time step in seconds. Default 30."},"secret":{"type":"string","maxLength":1024,"minLength":1,"description":"Base32-encoded shared secret."},"window":{"type":"integer","maximum":20,"minimum":0,"description":"Steps of drift tolerance each side. Default 1."},"algorithm":{"enum":["SHA1","SHA256","SHA512"],"type":"string","description":"HMAC algorithm. Default SHA1."},"timestamp":{"type":"integer","minimum":0,"description":"Unix time in seconds. Default: now."}},"additionalProperties":false},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.004","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.004/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_Gy5Zsml9nYMULn7_OMQlm","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.004","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Verifies a submitted TOTP code against a base32 secret with configurable clock-drift tolerance, returning whether the code is valid and the matching time-step offset.","exampleAgentPrompt":"The user just submitted the 6-digit code 847291 for two-factor authentication — can you verify it against the base32 secret JBSWY3DPEHPK3PXP using SHA1 with a drift window of 1 step?","exampleUseCases":[{"title":"MFA login gate for web app","prompt":"A user is logging into our platform and submitted the TOTP code 523814 from their authenticator app — please verify it against their stored secret MFRGGZDFMZTWQ2LK using the default 30-second period and SHA1, with a 1-step drift window."},{"title":"Custom-period HOTP migration check","prompt":"We migrated some accounts to 60-second TOTP periods — can you check if the code 091234 is valid for secret KRUGS4ZANFZSA2LTEB3GK43UMV2HG with a 60-second period, SHA256 algorithm, and a drift window of 2 steps?"},{"title":"Backdated OTP audit verification","prompt":"For a compliance audit I need to verify whether the code 774401 would have been valid at Unix timestamp 1700000000 against secret GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ with default settings."}],"resultDescription":"Returns a JSON object with a boolean 'valid' field indicating whether the submitted code matched, and an integer 'delta' field indicating the time-step offset (e.g. -1, 0, or 1) at which the match was found. A non-matching code returns valid=false with no error — only genuine processing failures produce errors.","failureModes":["Invalid or non-base32 secret returns an error","Code field empty or missing triggers a validation error","Window value out of range (>20) causes a schema rejection","Malformed request body returns 400-level error","Secret longer than 1024 characters rejected","Digits value outside 6-10 range causes validation failure"],"whenToPreferThis":"Use this endpoint when you need to verify a user-submitted TOTP code server-side as part of an MFA or 2FA flow, especially when you require configurable clock-drift tolerance, support for non-default algorithms (SHA256, SHA512), custom time-step periods, or need to know the exact step offset where the match occurred. Prefer it over rolling your own TOTP logic or using a general-purpose auth library when you want a stateless, pay-per-call microservice without managing dependencies.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T12:34:22.266Z","isFirstParty":false}