Public API — Share Auth

List a team's 2FA accounts and fetch their TOTP codes from your own tools, with a dedicated token.

The API lets an authorised client list a team’s 2FA accounts and fetch their TOTP codes.

export API_URL="https://app.shareauth.net"
export API_TOKEN="1|your-sanctum-token"

Use HTTPS only in production. Requests and responses are JSON.

Authentication

Create a Sanctum token:

curl -X POST "$API_URL/api/tokens/create" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "email":"[email protected]",
    "password":"password",
    "device_name":"my-connector",
    "code":"123456"
  }'

The code field is required only if the account protects its login with 2FA. recovery_code can be used instead.

Response:

{
  "token": "1|abcdefghijklmnopqrstuvwxyz",
  "user": {
    "id": 12,
    "name": "Alice",
    "email": "[email protected]"
  }
}

Keep this token as a secret, and send it in the header from then on:

Authorization: Bearer 1|abcdefghijklmnopqrstuvwxyz
Accept: application/json

Active team

The codes returned always belong to the user’s active team.

List the teams you can reach:

curl "$API_URL/api/v1/teams" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Accept: application/json"

Switch the active team:

curl -X POST "$API_URL/api/v1/teams/42/switch" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Accept: application/json"

List 2FA accounts

curl "$API_URL/api/v1/secrets" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Accept: application/json"

Shortened response:

{
  "data": [
    {
      "id": 7,
      "name": "GitHub production",
      "issuer": "GitHub",
      "digits": 6,
      "period": 30
    }
  ],
  "meta": {
    "total": 1,
    "limit": 10,
    "remaining": 9
  }
}

The TOTP seed is never included in responses.

Fetch a code

Use the identifier returned by the list:

curl -X POST "$API_URL/api/v1/secrets/7/generate" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Accept: application/json"

Response:

{
  "data": {
    "secret_name": "GitHub production",
    "code": "123456",
    "next_code": "654321",
    "time_remaining": 18,
    "period": 30,
    "expires_at": "2026-08-13T12:00:30.000000Z"
  }
}

Every generation is recorded in the team’s access log. Do not log the code on the client side.

Errors

Status	Meaning
`401`	token missing or invalid
`403`	access denied, or secret outside the active team
`404`	resource not found
`422`	invalid data, missing team, or code impossible to generate
`429`	rate limit of 60 requests per minute exceeded

A validation error generally follows this shape:

{
  "message": "The given data was invalid.",
  "errors": {
    "email": ["The email field is required."]
  }
}

MCP connector

The ready-made connector for ChatGPT, Codex, Claude and other MCP clients is documented in mcp-server/README.md, in the project repository.