Automating 2FA Login via API without SMTP: How to retrieve or inject OTP?
-
I'm working on automating a 2FA login flow for testing/scripting purposes using the FusionAuth API. My environment currently does not have SMTP configured, so I cannot rely on standard email delivery for the OTP.
I want to handle the 2FA authentication step purely via API using my FusionAuth API Key. Could anyone guide me on the best approach to achieve this?
Specifically, I have a few ideas based on the documentation but would love some community validation:
Provide a custom code: I noticed that the /api/two-factor/start endpoint allows you to pass a custom code in the request body. Is this the recommended way to bypass external delivery mechanisms during automation?
Use TOTP (Authenticator): Should I instead enable TOTP for the test user, grab the secretBase32Encoded via the /api/two-factor/secret endpoint, and programmatically generate the 6-digit code inside my test script using a TOTP library?
If anyone has a quick cURL example or best practice recommendations for handling this flow purely via API, I'd really appreciate it!
Thanks in advance!
-
Hey @sameer-syedmanzur!
If you're on any paid plan, I'd recommend looking at our Generic Messengers.
When the generic messenger is hit, it fires off a request to any HTTP endpoint you want. You can then use any method you need to to get the code to the user or post it back to the API to complete the 2nd factor.
If you're on the Community edition (free version), that's not accessible to you, though.
For solution on the community edition, check out this doc if you haven't read it yet: https://fusionauth.io/docs/lifecycle/authenticate-users/multi-factor-authentication#build-your-own-interface
That's how you set up a custom interface for TOTP. That would be the best-practice way of doing 2fa without smtp on community edition. I haven't done anything TOTP-based for testing, but I'd wager there's a TOTP application with an API that could handle this.
Depending on the use case, it might also make sense to set up something simple with something like MailTrap to do testing via SMTP instead of going through all this. That may be a problem depending on the use case, though