A PAT carries scoped groups and an expiry, so an agent gets codes for the accounts you allowed and no others, and the seeds never leave Authn8. An ambiguous lookup returning its candidates is the other good decision here — a wrong match would otherwise fail silently as a rejected code.
A server that returns TOTP codes from an Authn8 account, authenticated by a Personal Access Token. Every tool declares an output schema and returns structuredContent beside the text, so a client gets typed results without parsing JSON back out of prose.
- Every 2FA account the token can reach, each with its id, name and issuer domain
- A current TOTP code for one account, found by id or by a case-insensitive partial name match
- An ambiguous name answered with the candidates rather than a guess — the matches come back so the next call can name an id
- The token itself described: its name, the business, the groups it is scoped to, when it expires, and how many accounts it reaches
An Authn8 account and a Personal Access Token created in its dashboard, passed as AUTHN8_API_KEY — a pat_ token. Runs over stdio from npm as @authn8/mcp-server, or from the ghcr.io container image. AUTHN8_API_URL points it at a different API endpoint.
One command plus a key — npx @authn8/mcp-server, then supply credentials