otpauth_uri
Build or parse otpauth:// provisioning URIs from components like secret, label, and issuer. Supports TOTP and HOTP types.
Instructions
Build an otpauth:// provisioning URI from parts, or parse one (Key URI Format).
action=build (needs secret): assembles
otpauth://<type>/<label>?secret=...&issuer=... — secret is normalized to
canonical base32, type='hotp' requires counter, and counter/period
must match the type. action=parse (needs uri): returns type, the decoded
label (plus issuer/account split on the first ':'), secret, and the
algorithm/digits/period/counter parameters with their RFC defaults.
This codec never computes OTP codes; the base32 secret is passed through.
Example: otpauth_uri("build", label="alice@example.com", secret="JBSWY3DPEHPK3PXP",
issuer="Example") -> "otpauth://totp/Example:alice@example.com?secret=...&issuer=Example"
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| uri | No | The 'otpauth://...' URI to parse (action=parse). Default None. | |
| type | No | OTP kind: 'totp' (time-based, RFC 6238) or 'hotp' (counter-based, RFC 4226). Default 'totp'. | totp |
| label | No | Account label for build, e.g. 'alice@example.com'. If `issuer` is set and the label has no 'issuer:' prefix, one is added. Default None. | |
| action | Yes | 'build' assembles an otpauth:// URI from parts (needs `secret`); 'parse' splits one into its parts (needs `uri`). | |
| digits | No | Number of code digits (commonly 6 or 8). Default None. | |
| issuer | No | Provider name, e.g. 'Example Inc'. Default None. | |
| period | No | TOTP time step in seconds (totp only). Default None. | |
| secret | No | Base32 shared secret (RFC 4648, A-Z2-7) for build; spaces and '=' padding are ignored. Default None. | |
| counter | No | HOTP counter (required for and valid only with type='hotp'). Default None. | |
| algorithm | No | HMAC hash: SHA1 (default when omitted), SHA256, or SHA512. Default None. |