`GET /secrets`

List all OTP secrets, each with a live TOTP code.

Query params

ids (optional) — comma-separated list of secret IDs to filter by (e.g. ?ids=1,2,3)

Response 200

json

[
  {
    "id": 1,
    "name": "...",
    "email": "...",
    "secret": "...",
    "otp_type": "totp",
    "refresh_time": 30,
    "company_id": 1,
    "company_name": "...",
    "current_code": "123456",
    "seconds_remaining": 17
  }
]

`GET /secrets/<int:secret_id>`

Get a single secret with its current TOTP code.

Response 200 — same shape as one item above, plus time_left semantics via seconds_remaining.

Errors

404 {"error": "Secret not found"}
400 — invalid/corrupt secret format:

json

  {"error": "Invalid secret format. Run a database integrity check.", "fix_hint": "..."}

`POST /secrets`

Create a new secret. Requires permission: can_add_secrets.

Body (JSON)

json

{  "name": "string",  "email": "string (optional, default 'none')",  "secret": "string (16–128 chars after normalization)",  "otp_type": "string (optional, default 'totp')",  "refresh_time": "int (optional, default 30)",  "company_id": "int (optional, default 1)"}

Response 201

json

{"status": "created", "id": 42}

Errors

403 — missing permission
400 {"error": "Secret length invalid"}

`PUT /secrets/<int:secret_id>`

Update an existing secret. Requires permission: can_edit.

Body — same fields as POST /secrets.

Response 200

json

{"status": "updated"}

Errors

403 — missing permission
400 {"error": "Secret length invalid"}
404 {"error": "Secret not found"}

`POST /delete-secret`

Delete a secret. Requires permission: can_delete.

Body (form)

secret_id — required

Response

JSON clients: 200 {"status": "deleted", "id": 1}
Browser clients: redirect back to the referring page with a flash message

Errors

403 — missing permission
400 {"error": "Missing secret_id"}
404 {"error": "Secret not found"}
500 — unexpected error during deletion

{{ docTitle }}

{{ sec.heading }}