Give your agent 2FA codes without giving it your phone

Email codes arrive in the agent's own inbox. Authenticator codes come from ActAs, for only the logins you grant.

Most services ask for a second factor. Then the agent stops and waits for you to read out a code. ActAs lets the agent get the code itself, but only for the accounts you choose.

Email codes

If the service emails a code, it lands in the agent's own inbox:

actas mail INBOX_ID              # list messages, newest first
actas mail INBOX_ID MESSAGE_ID   # read one

Tell your agent: "When the site asks for an email code, check actas mail <inbox-id> every 15 seconds for up to 5 minutes, read the newest message from <service>, and type in the code."

Authenticator (TOTP) codes

You add the authenticator seed once. The agent never sees it; it only gets the current six-digit code.

1. You, in a private terminal with an owner connection: when the site shows "set up authenticator", copy the secret or the otpauth:// link, then run

   Terminal Copy

   actas totp add /research/supplier-portal

   then paste the seed, press Enter, and press Ctrl-D.

2. You give that agent access to the path:

   Terminal Copy

   actas grant add identity:AGENT_ID /research/supplier-portal totp:code

3. The agent, when the site asks for a code:

   Terminal Copy

   actas totp code /research/supplier-portal

   It gets the current code and the seconds left. Nothing else.

To take access away, revoke the grant or disconnect the agent's connection. Every code read shows in Activity.