# TOTP - Workflow node | Docs - nodulz

Source: https://nodulz.com/docs/nodes/totp

Language: en

Generate or verify one-time codes (2FA).

## Usage and specifics

Select a TOTP credential containing the seed or otpauth URI. Keep the clock synchronized. Seeds and codes are sensitive; do not put them in shared configuration.

Technical type : `totp`. Runtime : `nodulz`.

## Credentials and prerequisites

- [TOTP](/docs/credentials) (`integration` / `totp`). TOTP secret (base32 or otpauth:// URI)

Create credentials in your nodulz instance’s Credentials area, then select them on the node. Availability depends on ownership and sharing. See the [credentials guide](/docs/credentials) for access and rotation.

## Parameters

Names below are technical keys. Defaults are not a ready-to-run configuration: complete fields required by your operation. Paths containing [] describe list items; some fields depend on the selected mode.

| Parameter | Type | Default | Values / limits |
| --- | --- | --- | --- |
| `operation` | `enum` | `"generate"` | `generate`, `verify`, `create_secret` |
| `credentialId` | `string` | `""` | - |
| `secret` | `string` | `""` | - |
| `code` | `string` | `""` | - |
| `algorithm` | `enum` | `"sha1"` | `sha1`, `sha256`, `sha512` |
| `digits` | `number` | `6` | -; ≥ 6, ≤ 8 |
| `period` | `number` | `30` | -; ≥ 10, ≤ 300 |
| `window` | `number` | `1` | -; ≥ 0, ≤ 5 |
| `lastStep` | `string` | `""` | - |
| `issuer` | `string` | `""` | - |
| `accountName` | `string` | `""` | - |
| `secretLength` | `number` | `20` | -; ≥ 10, ≤ 64 |

## Configuration help

| Setting | Purpose and guidance |
| --- | --- |
| `operation`<br>Operation | Generate the current code, verify a submitted code or create a new secret. |
| `accountName`<br>Account | Shown in the authenticator app. |
| `issuer`<br>Issuer | Service name shown with the account. |
| `secretLength`<br>Secret size (bytes) | 20 bytes recommended. |
| `credentialId`<br>TOTP credential | Encrypted stored secret. Otherwise, enter it below. |
| `secret`<br>Secret | Base32 key or otpauth:// URI. URI parameters take precedence. |
| `code`<br>Code to verify | Code submitted by the user. |
| `algorithm`<br>Algorithm | SHA-1 for most authenticator apps. |
| `digits`<br>Digits | Code length. |
| `period`<br>Period (seconds) | How long each code is valid. |
| `window`<br>Tolerance (periods) | Periods accepted before and after, to absorb clock drift. |
| `lastStep`<br>Last accepted step | Replay protection: pass back the “step” stored at the last successful check. A code already used is rejected. |

## Initial configuration

Initial catalog configuration example, to adapt before running. Keep secrets in credentials.

```json
{
  "operation": "generate",
  "credentialId": "",
  "secret": "",
  "code": "",
  "algorithm": "sha1",
  "digits": 6,
  "period": 30,
  "window": 1,
  "lastStep": "",
  "issuer": "",
  "accountName": "",
  "secretLength": 20
}
```

## Verification

Test with representative data. Check node output in the inspector and logs, then use editor mapping for downstream fields. A trigger test with a simulated payload does not validate external service delivery.

See also : [Expressions and data](/docs/expressions), [Executions](/docs/executions), [Node catalog](/docs/nodes).

## Explore further

- [Features - nodulz](https://nodulz.com/product/overview)
- [Node catalog - nodulz](https://nodulz.com/product/catalog)
- [MCP server - nodulz](https://nodulz.com/product/mcp)
- [Pricing - nodulz](https://nodulz.com/pricing)
- [Use cases and workflow automation - nodulz](https://nodulz.com/use-cases)
- [Choose what your workflows can do. - nodulz](https://nodulz.com/compare)
- [Documentation - nodulz](https://nodulz.com/docs)