Skip to main content
MultiMFA logoMultiMFA
All Guides

RoboMFA API TOTP

Set up RoboMFA to give bots, AI agents, and automation secure API access to current TOTP codes with controlled secrets, audit, and policy controls.

Best for: Automation, RPA, and DevOps workflows that need MFA in non-human flows.

Overview

RoboMFA is designed for machines: add TOTP secrets once, then retrieve current codes programmatically for automation login flows.

Finding this in the dashboard

Admins click RoboMFA (MFA via API) in the dashboard sidebar to manage bot identities, TOTP secrets, and API credentials.

Step-by-step setup

  1. Step 1

    Open RoboMFA and create a bot identity

    Click RoboMFA (MFA via API) in the dashboard sidebar. Set up your workspace and prepare one bot identity per automation workflow.

  2. Step 2

    Generate API credentials for each bot

    Issue scoped credentials so each bot has an isolated access path and revocation point.

  3. Step 3

    Add required TOTP entries

    Store secrets for each service your automation needs to access, with clear labels and ownership notes.

  4. Step 4

    Integrate the generate-code endpoint

    Call the RoboMFA API from your automation at the moment the workflow reaches a 2FA checkpoint.

  5. Step 5

    Submit returned TOTP code in your workflow

    Use the returned 6-digit code to complete login and continue the automation run.

  6. Step 6

    Monitor usage and rotate credentials

    Track bot activity, rotate API credentials, and remove unused secrets or bot identities.

Best practices

  • Use one credential set per bot, not shared credentials.
  • Store bot credentials in your secret manager, never in source code.
  • Apply short credential rotation intervals for production bots.
  • Keep separate TOTP entries for dev, staging, and production.

Common troubleshooting

  • If calls fail, verify the bot token and endpoint environment.
  • If generated codes are rejected, check target account clock synchronization.
  • If automation intermittently fails at MFA, request the code closer to submission time.