Pass Secret Key to Generate TOPT in Website

[jcallahan526]

We are looking to store the encoded Secret Keys (generated by Salesforce) and generate the TOPT's on demand.

Is it possible to embed the Authenticator in an iframe and pass the Secret Keys?

If not can you direct us to the algorithm used to decode the Secret Keys?

[mymindstorm]

It is not possible to embed the extension in an iframe because it relies heavily on browser extension APIs. Furthermore, I suspect that whatever you are attempting to do will eradicate the security benifits of 2FA, especially since the secret would be stored outside of local storage.

The specification for TOTP is available here: https://datatracker.ietf.org/doc/html/rfc6238