{"openapi":"3.1.0","info":{"title":"TwoFactorGuide API","version":"0.1.0","description":"A 2FA/authenticator-app setup and backup-code best-practices guide plus a byte-correct RFC 6238 TOTP generator/validator. All local; the TOTP secret is never stored, logged, or transmitted.\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://twofactorguide.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"hr@unifydynamics.com","url":"https://connectorbay.com/twofactorguide/docs"},"termsOfService":"https://connectorbay.com/twofactorguide/terms"},"servers":[{"url":"https://twofactorguide.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/twofactorguide/docs"},"security":[{},{"bearer":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/compare_2fa_methods":{"post":{"operationId":"compare_2fa_methods","summary":"Compares SMS codes, authenticator-app TOTP codes, hardware security keys, and passkeys: how each","description":"Compares SMS codes, authenticator-app TOTP codes, hardware security keys, and passkeys: how each\n    works, real pros and cons, a strength tier, and a recommendation. SMS is vulnerable to SIM-swapping;\n    hardware keys and passkeys resist real-time phishing that SMS and TOTP apps do not. Use for \"which 2FA\n    method should I use\", \"is SMS 2FA safe\", \"authenticator app vs hardware key\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"compare_2fa_methodsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/totp_concept_explainer":{"post":{"operationId":"totp_concept_explainer","summary":"Explains how TOTP (time-based one-time password) actually works: the shared secret exchanged once at","description":"Explains how TOTP (time-based one-time password) actually works: the shared secret exchanged once at\n    setup, the time-derived counter, the HMAC and dynamic-truncation steps, why it depends on clock sync\n    between your device and the server, and why it works completely offline. Use for \"how does an\n    authenticator app code actually work\", \"why do 2FA codes expire every 30 seconds\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"totp_concept_explainerArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/generate_totp":{"post":{"operationId":"generate_totp","summary":"Computes the real, currently-valid RFC 6238 TOTP code for a given base32 secret -- the exact algorithm","description":"Computes the real, currently-valid RFC 6238 TOTP code for a given base32 secret -- the exact algorithm\n    every standard authenticator app uses (HMAC-SHA1/SHA256/SHA512 dynamic truncation, verified against the\n    RFC's own published test vectors). STATELESS and single-call-only: the secret is used only in memory for\n    this one computation and is never stored, logged, cached, or transmitted. Use for \"what's the current\n    TOTP code for this secret\", \"compute an 8-digit code with SHA256\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"secret":{"description":"The base32-encoded shared secret (the same text an authenticator app's QR code encodes). Used only in memory for this one call -- never stored or logged.","title":"Secret","type":"string"},"digits":{"default":6,"description":"Code length: 6, 7, or 8 digits. Google Authenticator-style apps use 6.","title":"Digits","type":"integer"},"algorithm":{"default":"SHA1","description":"HMAC hash: SHA1 (the near-universal default), SHA256, or SHA512.","title":"Algorithm","type":"string"},"period":{"default":30,"description":"Time-step length in seconds. Almost all real-world setups use 30.","maximum":300,"minimum":1,"title":"Period","type":"integer"},"for_time":{"anyOf":[{"type":"number"},{"type":"null"}],"default":null,"description":"Unix timestamp (seconds) to compute for; omit to use the current time.","title":"For Time"}},"required":["secret"],"title":"generate_totpArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/validate_totp":{"post":{"operationId":"validate_totp","summary":"Checks whether a supplied code is a valid RFC 6238 TOTP code for a given secret right now, tolerating","description":"Checks whether a supplied code is a valid RFC 6238 TOTP code for a given secret right now, tolerating\n    small clock drift by also checking neighboring time windows. STATELESS and single-call-only: the secret\n    is never stored, logged, cached, or transmitted. Use for \"is this TOTP code valid for this secret\", \"why\n    isn't my authenticator code working\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"secret":{"description":"The base32-encoded shared secret. Used only in memory for this one call -- never stored or logged.","title":"Secret","type":"string"},"code":{"description":"The numeric code to check.","title":"Code","type":"string"},"digits":{"default":6,"description":"Expected code length: 6, 7, or 8.","title":"Digits","type":"integer"},"algorithm":{"default":"SHA1","description":"HMAC hash: SHA1 (default), SHA256, or SHA512.","title":"Algorithm","type":"string"},"period":{"default":30,"description":"Time-step length in seconds.","maximum":300,"minimum":1,"title":"Period","type":"integer"},"window":{"default":1,"description":"How many time-steps before/after the current one to also check, to tolerate small clock drift.","maximum":10,"minimum":0,"title":"Window","type":"integer"},"for_time":{"anyOf":[{"type":"number"},{"type":"null"}],"default":null,"description":"Unix timestamp (seconds) to validate against; omit to use the current time.","title":"For Time"}},"required":["secret","code"],"title":"validate_totpArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/backup_codes_guide":{"post":{"operationId":"backup_codes_guide","summary":"Best practices for storing single-use 2FA backup/recovery codes: save them the moment they're shown,","description":"Best practices for storing single-use 2FA backup/recovery codes: save them the moment they're shown,\n    store them offline and separate from your normal 2FA device, and when to regenerate them. Use for \"how\n    should I store my backup codes\", \"where do 2FA recovery codes go\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"backup_codes_guideArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/lost_device_recovery_checklist":{"post":{"operationId":"lost_device_recovery_checklist","summary":"What to do if you lose the phone or key holding your 2FA -- and what to set up in advance so it isn't","description":"What to do if you lose the phone or key holding your 2FA -- and what to set up in advance so it isn't\n    a crisis. Use for \"I lost my phone with my authenticator app\", \"how do I recover 2FA access without my\n    device\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"lost_device_recovery_checklistArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}