Add TOTP two-factor with any authenticator app

WhatsApp OTP isn’t the only way to verify a user on Authevo. TOTP — the same standard behind the six-digit codes in Google Authenticator, Authy, and most password managers — is a second, fully independent method, live on the same API, billed from the same prepaid balance.

What TOTP actually verifies

A TOTP code isn’t sent anywhere — it’s computed. When a user enrolls, Authevo issues a shared secret; their authenticator app and Authevo’s server both derive the same six-digit code from that secret and the current time (RFC 6238), independently, every 30 seconds. There’s no message to deliver, so there’s no delivery cost, no carrier dependency, and nothing for a bot to intercept in transit.

Enroll, verify, disable — three calls

Call POST https://api.authevo.dev/v1/totp/enroll with { "phone": "+201234567890" }. The response returns a secret, an otpauth_url, and a ready-to-scan qr_code (base64 PNG) — show the QR code, the user scans it once, and their authenticator app is set up.

From then on, call POST https://api.authevo.dev/v1/totp/verify with { "phone": "+201234567890", "code": "123456" } — the six digits currently showing in the user’s app. A match returns { "data": { "verified": true, "first_confirm": true } }; first_confirm is true only on the very first successful verification, so you can show a one-time “now active” confirmation. A wrong or already-used code returns { "data": { "verified": false, "attempts_remaining": 4 } }.

To turn it off, call POST https://api.authevo.dev/v1/totp/disable with just the phone number. It’s a soft disable — the history stays auditable — and re-enrolling afterwards is a clean fresh start, no special flag required.

Why $0.002, not $0.01

WhatsApp OTP’s $0.01 rate reflects a real delivery cost. TOTP has none — it’s local math against a stored secret — so it’s priced at a flat $0.002 per verification instead, with no per-message tier to reason about. It draws from the exact same prepaid balance as WhatsApp OTP (top up once, spend on either method), and your first 50 free verifications cover TOTP just as they cover WhatsApp.

Try the whole flow with no signup at all in the Playground, or read the full parameter and error-code reference in the docs.