TOTP Setup Guide

Overview

Shoonya's programmatic login replaces the SMS/app OTP step with a TOTP (Time-based One-Time Password) secret, the same standard used by Google Authenticator. Once enrolled, your script generates the current OTP locally instead of waiting on an SMS.

Enrollment steps

1. Log in to the Shoonya web terminal and open Profile → Security → TOTP Setup.
2. Scan the displayed QR code with an authenticator app, or copy the raw base32 secret shown below it.
3. Enter the 6-digit code your app generates to confirm enrollment.
4. Store the base32 secret — this is what your code uses to generate OTPs programmatically. It is shown only once.

Generating OTPs in code

import pyotp

totp = pyotp.TOTP("YOUR_BASE32_SECRET")
current_otp = totp.now()
print(current_otp)  # 6-digit code, valid ~30 seconds

Best practices

• Store the TOTP secret with the same care as a password — anyone with it can generate valid login codes for your account.
• Keep the host machine's clock synced (NTP) — TOTP codes are time-window based and drift causes login failures.
• Re-enroll immediately if you ever suspect the secret has been exposed; the old secret is invalidated the moment a new one is generated.

Notes

Continue to Auto Login (TOTP) to use this secret in an authenticated request.