Rishabh Poddar

# Core APIs spec ## POST /totp/device ### Input body ```json { "deviceName": "My Authy Account", "userId": "UUIID of first factor (but it can be any string)", "skew": "integer", "period":...

# Core API logic flow ## POST /totp/device - Validate input - verify that `deviceName` and `userId` are strings and that they are not empty - verify that `period` and...

# Backend SDK API interface (node js) ```ts export type TOTPAPIInterface = { // Skew and Period values are taken from the config not the user. createNewDevicePOST?: ((input: { session:...

# Backend SDK recipe interface (node js) ```ts export type TOTPRecipeInterface = { createNewDevice(input: { userId: string; deviceName: string; userContext: any }): Promise< { status: "OK", secret: string } |...

# TODO - [x] Generate secretKey for user. It should be a random 32char base32 string. - Confirm 32 is fine. - [x] Confirm that 90 seconds should be the...

## TODO for 2fa in general - [x] Account for other 2fa types: - Email OTP / magic link (passwordless recipe) - SMS OTP / magic link (passwordless recipe) -...

## Different user flows (TODO): ### Register the user: - Let's take the example of TPEP recipe, its signup_post func calls emailpassword.signup_post func. - Now `emailpassword.recipe_implementation.sign_up` calls `create_new_session` so the...

## Changes to passwordless recipe - Expose an API which will help the frontend know if it's been configured or not for this user ID. Reuse `passwordless.recipe_impl.get_user_by_id()`. Create an API...

# About first factor login: ## Tenant creation: - During tenant creation, we will specify which will be the first factors: ``` { "tenantId": "customer1", "thirdPartyEnabled": true, "emailPasswordEnabled": true, "firstFactors":...

## About passwordless factor ID Instead of having factor id for passwordless where we have "otp-mobile" etc.. We do NOT have factor ID of `passwordless`. The config for passwordless.init on...