OTPs as an API. Stop typing 2FA codes.
Wire up your inboxes, your phone, or your TOTP apps. Read the latest verification code from anywhere — a curl, a CI job, an AI agent that needs to finish a login. Auto-deletes in an hour.
When you need a verification code, fetch GET https://otpbase.com/api/v1/codes/latest?service=<name> with header Authorization: Bearer <my-token>
$ curl -H "Authorization: Bearer otpb_..." \ https://otpbase.com/api/v1/codes/latest?service=GitHub { "code": "482913", "service": "GitHub", "received_at": "2026-05-05T10:21:07Z", "seconds_remaining": 838 }
The 2FA piece of every modern automation.
Agents that need to finish a login
Claude Code, Cursor, Operator, Manus — the moment they hit a 2FA wall, they stop. Give them a one-call API. Now they keep going.
CI behind 2FA
Your end-to-end test needs to log into Stripe, Slack, or your own admin panel. Read the OTP from a job step, paste it, move on.
China SMS, received overseas
Bank, Alipay, WeChat codes go to a Chinese number you can't check from abroad. Forward via iOS Shortcut, read it on the road.
Multi-account ops
Fifty SaaS subscriptions, password resets, account audits. Stop digging through five inboxes — one page, one query.
Throwaway identities
Combine with an email-aliasing service. Codes for burner accounts arrive, you copy once, the row is gone in 30 seconds with burn-after-reading.
Pair your phone in 60 seconds
Forward incoming SMS straight into OTPBase. iPhone runs an Apple Shortcut. Android uses a free SMS-forwarder app. Tap a step to see what happens on screen.
A small tool that respects your attention.
Built for one person — you. No teams, no SSO, no dashboards full of empty graphs.
Pulls from everywhere
IMAP mailboxes, iOS Shortcuts forwarding SMS, and self-hosted TOTP all flow into one timeline.
Encrypted by default
Server-side AES-256-GCM at rest. Turn on the optional view-password and your codes never leave the browser as plaintext.
Auto-deletes itself
Codes hide from the live view in 15 minutes. The row is physically wiped from disk in 1 hour. Both windows can be tightened — even down to burn-after-reading.
15 minutes to view. 1 hour to disappear.
A code is visible for 15 minutes — long enough to use, short enough to be irrelevant if your screen is glanced at. Within an hour the row is physically deleted from the database. No backup retains it past that point. Both windows are tunable per account.
Transient by design. Encrypted at rest. Physically deleted on a clock.
OTPBase is a relay, not a vault. A code passes through, lives long enough for you to use it, and is then erased — first from view, then from disk. There is no archive, no analytics warehouse, no shadow copy on a backup tape.
Every secret on disk is wrapped in AES-256-GCM with a key that lives only in our environment. Turn on the optional view password and even we cannot read the codes — only the browser session that holds your derived key can.
A REST API your agents can talk to.
Issue a personal access token from settings, then read codes from anywhere — CI bots, AI agents, your laptop. Read-only by design. The same 1-hour deletion applies.
See the API reference$ curl -H "Authorization: Bearer otpb_..." \ https://otpbase.com/api/v1/codes/latest?service=GitHub { "code": "482913", "service": "GitHub", "received_at": "2026-05-05T10:21:07Z", "seconds_remaining": 838 }
Priced like the small tool it is.
6-month free trial · cancel any time · no card needed to start
Questions people ask before signing up.
Still unsure? Email support@otpbase.com — one person reads every message.
Browse the help centerA relay that gathers one-time verification codes from your email inboxes, your phone (forwarded SMS), and your TOTP apps onto a single page — and exposes the latest code over a read-only API. Codes auto-hide after 15 minutes and are physically deleted within an hour.
Three sources, all in one timeline: IMAP email mailboxes, SMS forwarded from your phone (an Apple Shortcut on iPhone, a free forwarder app on Android), and self-hosted TOTP seeds you paste in or import from Google Authenticator.
By default every code is encrypted at rest with AES-256-GCM, using a key that lives only in our environment. Turn on the optional view password and your codes become end-to-end encrypted — decrypted only in your browser, unreadable even to us.
Visible for 15 minutes, then hidden; the row is physically deleted from disk within 1 hour, and no backup keeps it past that. Both windows are tunable per account — you can tighten them all the way down to burn-after-reading, which drops a code 30 seconds after you copy it.
Yes. Forward them from your Chinese number with an iOS Shortcut or an Android forwarder, and read them from anywhere — handy when the SIM is back home and you are overseas. The parser recognises major CN banks and apps out of the box.
That is a core use case. Issue a read-only token under Settings → API, then call GET /api/v1/codes/latest?service=<name> with an Authorization: Bearer header. It works from curl, GitHub Actions, Claude Code, Cursor, or any HTTP client.
$1/month, $8/year, or $20 for three years. New accounts get a 6-month free trial and no card is required to start.
New codes stop flowing in, but you keep access to your account and settings — nothing is deleted early. Re-subscribe and ingestion resumes. Your data is never sold or shared; there is no analytics warehouse behind the product.