TOTP

Node catalog Transformations

On this page

Generate or verify one-time codes (2FA).

Usage and specifics

Select a TOTP credential containing the seed or otpauth URI. Keep the clock synchronized. Seeds and codes are sensitive; do not put them in shared configuration.

Technical type : totp. Runtime : nodulz.

Credentials and prerequisites

TOTP (integration / totp). TOTP secret (base32 or otpauth:// URI)

Create credentials in your nodulz instance’s Credentials area, then select them on the node. Availability depends on ownership and sharing. See the credentials guide for access and rotation.

Parameters

Names below are technical keys. Defaults are not a ready-to-run configuration: complete fields required by your operation. Paths containing [] describe list items; some fields depend on the selected mode.

Parameter	Type	Default	Values / limits
`operation`	`enum`	`"generate"`	`generate`, `verify`, `create_secret`
`credentialId`	`string`	`""`	-
`secret`	`string`	`""`	-
`code`	`string`	`""`	-
`algorithm`	`enum`	`"sha1"`	`sha1`, `sha256`, `sha512`
`digits`	`number`	`6`	-; ≥ 6, ≤ 8
`period`	`number`	`30`	-; ≥ 10, ≤ 300
`window`	`number`	`1`	-; ≥ 0, ≤ 5
`lastStep`	`string`	`""`	-
`issuer`	`string`	`""`	-
`accountName`	`string`	`""`	-
`secretLength`	`number`	`20`	-; ≥ 10, ≤ 64

Configuration help

operation Operation: Generate the current code, verify a submitted code or create a new secret.
accountName Account: Shown in the authenticator app.
issuer Issuer: Service name shown with the account.
secretLength Secret size (bytes): 20 bytes recommended.
credentialId TOTP credential: Encrypted stored secret. Otherwise, enter it below.
secret Secret: Base32 key or otpauth:// URI. URI parameters take precedence.
code Code to verify: Code submitted by the user.
algorithm Algorithm: SHA-1 for most authenticator apps.
digits Digits: Code length.
period Period (seconds): How long each code is valid.
window Tolerance (periods): Periods accepted before and after, to absorb clock drift.
lastStep Last accepted step: Replay protection: pass back the “step” stored at the last successful check. A code already used is rejected.

Initial configuration

Initial catalog configuration example, to adapt before running. Keep secrets in credentials.

json

{
  "operation": "generate",
  "credentialId": "",
  "secret": "",
  "code": "",
  "algorithm": "sha1",
  "digits": 6,
  "period": 30,
  "window": 1,
  "lastStep": "",
  "issuer": "",
  "accountName": "",
  "secretLength": 20
}

Verification

Test with representative data. Check node output in the inspector and logs, then use editor mapping for downstream fields. A trigger test with a simulated payload does not validate external service delivery.