One-time password key URI (otpauth)

ID otpauth_uri

DatatypeNot PIIDraft

This record is a draft: it has not been reviewed yet and may be incomplete or wrong. Do not rely on it for compliance decisions. Help improve it (see CONTRIBUTING.md).

URI that provisions an HOTP or TOTP one-time password generator, usually shown as a QR code: otpauth://TYPE/LABEL?PARAMETERS, where TYPE is hotp or totp, the label names the account and the issuer, and the secret parameter carries the shared key in Base32. Whoever has the URI can generate the second factor of the account.

Categories: Secrets and credentials (passwords, keys, tokens)
Countries: Global (not tied to a country)
Languages: Common to most languages
Quality: 78/100 · missing: second example, mapping (Wikidata, Schema.org, ...), translation
Metacrafter rules: no detection rule yet
Supported by tools: pyWhat

Regular expression

^otpauth://(?:totp|hotp)/[^?\s]+\?(?:\S*&)?secret=[A-Za-z2-7]+=*(?:&\S*)?$

Python re syntax.

Examples

Value	Description
otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example	Example from the Key Uri Format specification
otpauth://totp/Example:alice@google.com?issuer=Example invalid	No secret

Sources

doc: https://github.com/google/google-authenticator/wiki/Key-Uri-Format

Use this record

Page URL: https://registry.apicrafter.io/datatype/otpauth_uri
JSON: API v1 · legacy shape (used by metacrafter) · Markdown (for LLMs)
Improve it: edit data/datatypes/any/secrets/otpauth_uri.yaml on GitHub