Store your two-factor (2FA) accounts in a secure web vault — then fetch
live TOTP codes from scripts, CI/CD pipelines, and automations with a single
curl. No phone in the loop.
# your 2FA codes, one request away $ curl -H "X-API-Key: tv_…" https://latch.cc/api/codes { "codes": [{ "issuer": "GitHub", "code": "238947", "seconds_remaining": 22 }] }
CI jobs, scrapers, RPA bots, and test suites hit walls at the 6-digit prompt. Fetch the current TOTP code over HTTPS and keep the pipeline moving.
Drop a screenshot of any 2FA setup QR code into the vault — decoded in your browser, never uploaded. Or paste the setup key.
The same vault serves the web UI and the API. Watch codes tick with a live
countdown, click to copy, or curl them from any machine.
Secrets are Fernet-encrypted at rest and every vault is scoped to its owner. Your API key unlocks your codes only.
RFC 6238 compliant — SHA-1/256/512, 6–8 digits, any period. Works with Google, GitHub, AWS, banks, anything that shows a TOTP QR.
Create an account, add up to 50 authenticator entries, and use the full API. No card required.
Email + password. Your personal API key is minted instantly.
Screenshot the QR code a website shows during two-factor setup and drop it in — or paste the "can't scan?" setup key.
Read codes in the dashboard, or call /api/codes with your key
from scripts, CI/CD, cron — anything that speaks HTTP.
A regular authenticator app stores TOTP secrets and shows rotating 6-digit codes on a phone. Latch does the same in a web vault — and also exposes the live codes over an authenticated HTTP API, so software can read them programmatically.
curl -H "X-API-Key: YOUR_KEY" https://latch.cc/api/codes returns
every account's current code plus seconds_remaining in its window.
/api/codes/<id> returns one.
Yes — free accounts get the web vault, QR import, and full API access for up to 50 authenticator entries.
Secrets are encrypted at rest, traffic is HTTPS, vaults are isolated per user, and API keys are stored hashed. The honest caveat: whoever holds your API key can read your codes. That's the point for automation — treat the key like a password.
Primary use case. Store a test account's TOTP secret once; your pipeline fetches a fresh code at login time. No more hard-coding OTP seeds into test repos.
Anything that offers "authenticator app" two-factor: Google, GitHub, AWS, Microsoft, banks, exchanges, hosting providers — if it shows a TOTP QR code or setup key, it works.