How can an AI agent use an authenticator code?
If the service supports TOTP, an authorized workflow can get the current code from the authenticator enrolled for that account and enter it at the login prompt.
The setup secret is a credential. Protect it, and limit which workflow can use it.
TOTP, the time-based one-time password, works out a short-lived code from a shared secret and the time. The default time step in RFC 6238 is 30 seconds, though a service can use other settings.
Check the setup
- Enroll an authenticator through the service's own security settings. Save any recovery method the way the service tells you to.
- Give only the intended workflow permission to use the authenticator. Do not paste its secret into a prompt, a log or a shared document.
- At the login prompt, get the current code and enter it promptly. Never assume every service uses six digits or the same time step.
- If the code fails, check the account, the authenticator settings and the clock. Follow the service's recovery instructions rather than guessing again and again.
TOTP codes are not phishing-resistant: a fake site can ask for a valid code. Check the site before entering one.
ActAs keeps the authenticator secret and gives an agent the current code for only the logins you grant it. The guide to 2FA codes shows the steps.