Delphi TOTP Two-Factor Authentication
Add a second factor to any login with the six digit codes of Google Authenticator, Microsoft Authenticator or Authy. Create the secret, show it as a QR code and verify the codes on your server.
Add a second factor to any login with the six digit codes of Google Authenticator, Microsoft Authenticator or Authy. Create the secret, show it as a QR code and verify the codes on your server.
A non-visual component that implements time-based (RFC 6238) and counter-based (RFC 4226) one-time passwords. It never opens a connection, so it works in a login form, a REST API or a WebSocket server alike.
TsgcTOTPAuthenticator (unit sgcAuth_TOTP)
Windows, macOS, Linux, iOS, Android
Enterprise and All-Access, plus the sgcAuth pack. Also available in sgcWebSockets .NET.
Call GenerateSecret once per user, show GetProvisioningURI as a QR code, store the secret, and check every code typed at sign in with VerifyCode.
uses
sgcAuth_TOTP;
var
TOTP: TsgcTOTPAuthenticator;
vSecret, vURI: string;
begin
TOTP := TsgcTOTPAuthenticator.Create(nil);
TOTP.Issuer := 'Example App';
// enrolment: a new Base32 secret and the otpauth:// URI for the QR code
vSecret := TOTP.GenerateSecret;
vURI := TOTP.GetProvisioningURI('alice@example.com', vSecret);
// save vSecret with the user record, render vURI as a QR code
// sign in: check the code typed by the user
if TOTP.VerifyCode(vSecret, edtCode.Text) then
ShowMessage('Code accepted');
// one-time recovery codes for a lost phone
TOTP.GenerateRecoveryCodes(memoRecovery.Lines, 10);
end;// uses: sgcAuth_TOTP
TsgcTOTPAuthenticator *TOTP = new TsgcTOTPAuthenticator(this);
TOTP->Issuer = "Example App";
String Secret = TOTP->GenerateSecret();
String URI = TOTP->GetProvisioningURI("alice@example.com", Secret);
if (TOTP->VerifyCode(Secret, edtCode->Text))
ShowMessage("Code accepted");
TOTP->GenerateRecoveryCodes(memoRecovery->Lines, 10);Everything a second factor needs, from the first QR code to the recovery of a lost device. Storing the secrets stays in your hands.
GenerateSecret returns a random Base32 secret of SecretLength bytes (20 by default). GetProvisioningURI builds the otpauth://totp/ URI with Issuer, Algorithm, Digits and Period, ready to render as a QR code.
VerifyCode accepts the current time step and Window steps before or after it (1 by default), so a phone whose clock is a few seconds off still signs in.
The VerifyCode overload with aLastTimeStep only accepts a time step greater than the last one used and returns the matched step, so a code can never be used twice.
GenerateHOTP and VerifyHOTP implement the counter-based variant for hardware tokens, with a look-ahead window that resynchronises the counter on success.
GenerateRecoveryCodes fills any TStrings with unique one-time codes, the fallback when the user loses the device with the authenticator app.
HMAC-SHA1 (the default every app supports), HMAC-SHA256 or HMAC-SHA512 through Algorithm, codes of 6 to 8 Digits and any Period.
Authoritative sources for the standards this component implements.
Deep-link to the component reference, grab the ready-to-run demo project, and download the trial.
| Online Help: TsgcTOTPAuthenticator Full property and method reference for this component. | Open | |
| Demo Project: Demos\26.Authentication\02.TOTP Enrolment with a QR code, live codes, verification with replay protection and recovery codes. Ships inside the sgcWebSockets package, download the trial below. | Open | |
| Technical Document (PDF) Features, quick start, code samples for Delphi & C++ Builder and primary-source references for this component only. | Open | |
| User Manual (PDF) Comprehensive manual covering every component in the library. | Open | |
| Blog: Delphi Login With Passkeys, SAML SSO, LDAP and TOTP 2FA How the six authentication components fit together in one Delphi application. | Open |