Is it possible to generate a Twilio "OneCode" TOTP token programmatically?

Question

Goal

I have a backend service that talks to AWS, and an automated tool that acquires AWS creds. The cred-getter has MFA enabled (not my choice), but I don't want to type in or copy a code. Instead, I want to write a bit of code that can programmatically generate or get a TOTP soft-token without texting or calling anyone. So today our workflow is like this:

call cred getter from cli => open authy app for totp code => paste into cli

but i want it to look like this:

call my custom cli => it makes a totp code and passes it to cred getter for me

Question

Is there a way to curl Authy or Twilio to get one of these soft tokens programmatically?

Existing Docs

There's sort of a circular maze of documentation that appears relevant to this question, but I can't break the circle.

 ----->  Twilio has a page describing TOTP:
|      |   https://www.twilio.com/authy/features/totp
|      |
|      | It links to a page describing OTP API access:
|      |   https://www.twilio.com/authy/api#softtoken
|      |
|      | That explains you can "build your own SDK-supported mobile authentication application.":
|      |   https://www.twilio.com/docs/authy/api/one-time-passwords#other-authenticator-apps
^      v
|      |
|      | Which links to the quick start page:
|      |   https://www.twilio.com/docs/authy/twilioauth-sdk/quickstart 
|      |
 <-----  Which has a link about TOTP, which takes you back to the beginning

I see that the native mobile SDK's can generate a TOTP token: https://www.twilio.com/docs/authy/twilioauth-sdk/quick-reference#time-based-one-time-passwords-totp

but I want to generate a token on a laptop (or cloud function or just someplace). The Authy Desktop client is doing it, so I know there must be a way. But I don't know what has been publicly exposed.

This question is relevant: how to get Google or Authy OTP by API

but the only answer depends on twilio calls and texts still: how to get Google or Authy OTP by API so that would be prohibitively expensive

Answer 1

Twilio developer evangelist here.

From what you've said, your credential getter provides you a QR code with which you then configure Authy to generate OTP codes.

The QR code encodes a URL in the following format:

otpauth://TYPE/LABEL?PARAMETERS

For example:

otpauth://totp/Example:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=Example

The type is likely "totp", like the example, the label will refer to the app you're authenticating with. The important part is the secret in the parameters. The secret is a base 32 encoded key that you can use to generate TOTP codes using the TOTP algorithm. There is likely an implementation of the algorithm in you preferred language.

Find the secret and you can generate your codes.