---
id: "otpauth_uri"
kind: "datatype"
status: "draft"
is_pii: false
categories: ["secrets"]
langs: ["common"]
quality: 78
url: "https://registry.apicrafter.io/datatype/otpauth_uri"
---

# One-time password key URI (otpauth) (`otpauth_uri`)

> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.

URI that provisions an HOTP or TOTP one-time password generator, usually shown as a QR code: otpauth://TYPE/LABEL?PARAMETERS, where TYPE is hotp or totp, the label names the account and the issuer, and the secret parameter carries the shared key in Base32. Whoever has the URI can generate the second factor of the account.

- Personal data (PII): no
- Categories: Secrets and credentials (passwords, keys, tokens) (secrets)
- Countries: global
- Languages: Common to most languages (common)

## Detection

Regular expression (Python `re`):

```
^otpauth://(?:totp|hotp)/[^?\s]+\?(?:\S*&)?secret=[A-Za-z2-7]+=*(?:&\S*)?$
```

## Examples

- `otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example` — Example from the Key Uri Format specification
- `otpauth://totp/Example:alice@google.com?issuer=Example` (invalid example) — No secret

## Supported by tools

- `pywhat`

## Sources

- doc: <https://github.com/google/google-authenticator/wiki/Key-Uri-Format>

## Quality

Score 78/100. Missing: second example, mapping (Wikidata, Schema.org, ...), translation.

JSON: <https://registry.apicrafter.io/api/v1/datatypes/otpauth_uri.json> · Edit: <https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/secrets/otpauth_uri.yaml>