oathtool is a command-line tool and Python library for generating one-time passwords, supporting both HOTP (HMAC-based) and TOTP (Time-based) algorithms. The current version is 2.4.0, and it maintains a stable, albeit infrequent, release schedule, focusing on reliability and security.
pip install oathtoolVerified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates how to generate a TOTP code using a base32-encoded secret key, typically obtained from a 2FA setup process. It emphasizes retrieving the secret securely from an environment variable and includes basic error handling for common key issues.
Ensure your secret key is a valid base32-encoded string (e.g., from a QR code or provided by the service). Tools like `base64.b32decode` can verify format.
Always store secret keys securely. Use environment variables (as shown in quickstart), dedicated secret management services, or secure configuration files. For CLI, `oathtool` offers keyring integration.
Implement a robust mechanism to store and increment the HOTP counter reliably. Both client and server must agree on the current counter value. If out of sync, a resynchronization process is usually required.