Testing

Two ways to generate SmartOTP codes without the SDK: a standard authenticator app for basic OTP, and a Python script that covers both basic and advance codes.

Basic OTP with Google Authenticator

Register a new Soft OTP and note the key from the Activate response:

{
  "success": true,
  "code": 1,
  "message": "success",
  "data": {
    "key": "fake_client_secret_key",
    "period": 15,
    "algorithm": "HmacSHA512",
    "length": 6,
    "type": "totp",
    "issuer": "SOTP"
  }
}

Generate the QR code locally — for example pyotp.TOTP(...).provisioning_uri() piped to qrencode — with these values:

Field	Type	Description
Type	TOTP	Time-based.
Secret	fake_client_secret_key	The key from the response, with the trailing = removed.
Label	Cake-Soft-OTP	Display label.
Issuer	Cake	Display issuer.
Algorithm	SHA-512	Must match HmacSHA512.
Length	6 digits	Code length.
Period	15	Seconds per code.

The trailing = is Base32 padding. Authenticator apps reject the secret unless you strip it.

WARNING

This puts a live client secret into a consumer authenticator app. Use it only with test credentials on a non-production tenant — never with a real customer's secret.

Both OTP Types with Python

pip install pyotp
# or
pip3 install pyotp

Replace client_secret with the key from Activate, and challenge with the challenge_key from Create Transaction:

import pyotp
import hashlib
import base64

client_secret = "fake_client_secret_key"
challenge = "fake_challenge_key"

def gen_opt(secret) -> str:
    totp = pyotp.TOTP(secret, 6, hashlib.sha512, "CAKE", "CAKE", 15)
    return totp.now()

def gen_secret_from_challenge(secret, challenge) -> str:
    src = secret + "-" + challenge
    m = hashlib.sha512()
    m.update(bytes(src, 'utf-8'))
    return base64.b32encode(m.digest())

otp = gen_opt(client_secret)
print("Basic OTP: ", otp)

secret = gen_secret_from_challenge(client_secret, challenge)
advance_otp = gen_opt(secret)
print("Advance OTP: ", advance_otp)

python otp.py
# or
python3 otp.py

Basic OTP:  123456
Advance OTP:  654321

The advance secret is derived by joining the client secret and challenge key with a -, hashing with SHA-512, and Base32-encoding the digest. That derived value is then used as an ordinary TOTP secret.

Next Steps

• Validate OTP — verify the codes you generate here
• SmartOTP Overview — how basic and advance codes differ