m2fa · docs

Private OTP vault API

HTTPS REST for the extension and scripts. Live keys stay in your vault session — snippets use $M2FA_KEY. Paste llm.txt into a model so it does not invent routes.

Dashboard

llm.txt

For models. What m2fa is, the two planes, every REST field. Alias /llms.txt.
https://m2fa.strogleapp.com/llm.txt
Open Download

docs.md

Human markdown for the same REST API. Good for README-style reading.
https://m2fa.strogleapp.com/docs.md
Open Download

HTML

This page. Open in a browser, copy the source, download the file, or share the URL.
https://m2fa.strogleapp.com/docs
Download

Auth

Send the personal key as X-Api-Key, X-Flow-Hash, or Authorization: Bearer. Missing/invalid → 403. Each key only sees its own vault. 120 calls / 60 seconds / IP.

Routes

MethodPathAuthNotes
GET/healthnoLiveness
GET/authskeyList accounts, no secrets
GET/auths/{id}keyCurrent OTP. HOTP increments
POST/addkeyCreate, HTTP 201
GET/logos/{slug}noCached brand logo
GET/auths/icons/{name}keyLogo or letter badge
GET/llm.txtnoLLM spec (alias /llms.txt)
GET/docs.mdnoMarkdown
GET/docsnoThis page

Quick start

export M2FA_KEY='m2fa_YOUR_USER_KEY'
curl -sS https://m2fa.strogleapp.com/health
curl -sS https://m2fa.strogleapp.com/auths -H "X-Api-Key: $M2FA_KEY"
curl -sS https://m2fa.strogleapp.com/auths/12 -H "X-Api-Key: $M2FA_KEY"
curl -sS -X POST https://m2fa.strogleapp.com/add \
  -H "X-Api-Key: $M2FA_KEY" -H "Content-Type: application/json" \
  -d '{"uri":"otpauth://totp/Example:demo?secret=JBSWY3DPEHPK3PXP&issuer=Example"}'

List item

{
  "id": 12,
  "service": "GitHub",
  "account": "you",
  "icon": "github",
  "logo": "github",
  "logo_url": "/logos/github",
  "otp_type": "totp",
  "digits": 6,
  "period": 30,
  "algorithm": "sha1"
}

Current code

{
  "otp_type": "totp",
  "password": "123456",
  "next_password": "654321",
  "generated_at": 1710000000,
  "period": 30,
  "counter": null
}

Errors

StatusMeaning
201Created (POST /add)
400Bad OTP payload / duplicate
403Missing or invalid API key
404Account id not in this vault
429Too many API calls

Dashboard

Human login is WebSocket-only: wss://m2fa.strogleapp.com/ws/. Do not POST credentials to Flask. Do not open WSS via a bare IP on port 443. Admin-only work (users, attaching OTPs to other vaults, audit) is on that socket, not this REST API.

Chrome extension: load extension/ or ext.zip, paste the user’s key, point it at https://m2fa.strogleapp.com.

Copied