Add TOTP two-factor with any authenticator app

WhatsApp OTP isn’t the only way to verify a user on Authevo. TOTP — the same standard behind the six-digit codes in Google Authenticator, Authy, and most password managers — is a second, fully independent method, live on the same API, billed from the same prepaid balance.

What TOTP actually verifies

A TOTP code isn’t sent anywhere — it’s computed. When a user enrolls, Authevo issues a shared secret; their authenticator app and Authevo’s server both derive the same six-digit code from that secret and the current time (RFC 6238), independently, every 30 seconds. There’s no message to deliver, so there’s no delivery cost, no carrier dependency, and nothing for a bot to intercept in transit.

Enroll, verify, disable — three calls

Call POST https://api.authevo.dev/v1/totp/enroll with { "phone": "+201234567890" }. The response returns a secret, an otpauth_url, and a ready-to-scan qr_code (base64 PNG) — show the QR code, the user scans it once, and their authenticator app is set up.

From then on, call POST https://api.authevo.dev/v1/totp/verify with { "phone": "+201234567890", "code": "123456" } — the six digits currently showing in the user’s app. A match returns { "data": { "verified": true, "first_confirm": true } }; first_confirm is true only on the very first successful verification, so you can show a one-time “now active” confirmation. A wrong or already-used code returns { "data": { "verified": false, "attempts_remaining": 4 } }.

To turn it off, call POST https://api.authevo.dev/v1/totp/disable with just the phone number. It’s a soft disable — the history stays auditable — and re-enrolling afterwards is a clean fresh start, no special flag required.

Why TOTP is a flat $0.002

TOTP has no delivery cost — it is local math against a stored secret — so it is priced at a flat $0.002 per verification, with no destination or per-message tier. WhatsApp shared-number prices are separate and vary by country; $0.01 is the steady-state Egypt and own-number software rate. Both methods draw from the same prepaid balance, and the first 50 free verifications cover TOTP as well as WhatsApp.

Try the whole flow with no signup at all in the Playground, or read the full parameter and error-code reference in the docs.