Use one-time codes in API tests

Test a sign-in with two-step codes: keep the authenticator's secret as a variable and let each request make the current code.

In short

A test of a two-step sign-in needs the current six-digit code. Keep the authenticator's secret as a secret variable, and write {{$totp:NAME}} where the code goes: each request makes the code from the secret at that moment.

Steps

1. Open the API Tester environment and press "Add variable".
2. Name it, for example otp, paste the authenticator's base32 secret or its otpauth:// address, and tick "Secret".
3. In the request, write {{$totp:otp}} where the code goes, then send it.

Good to know

• The code follows the usual authenticator rule: six digits, a new one every 30 seconds.
• One request uses the same code everywhere it appears.
• The secret and the code are never shown in a kept result. Use a test account, never a real person's.
• The same works when a coding agent's tests run on its preview and in the CLI.

Related

• /help/api-testing/variables
• /help/api-testing/authentication