The authenticator code

totpCodeOf(secret, at?) is the six-digit code an authenticator app shows for an account's setup key: RFC 6238, HMAC-SHA-1, a 30-second step, six digits, over the base32 key Instagram shows when the account sets its authenticator app up. It is what a program with no person at the other device submits to the two-factor code screen. Import it from @igpapi/android (or @igpapi/ios).

import { totpCodeOf } from '@igpapi/android';

// The setup key comes from your secret store; the code is computed where it is submitted.
const code = totpCodeOf(process.env['IG_TOTP_SECRET'] ?? '');
console.log(code);

• Compute it at the submit. A code is valid for its 30-second step: codeScreen.submitCode(totpCodeOf(secret)) reads the clock when the code is sent; a code kept from the start of the program is stale by then.
• The moment is the clock's by default; at takes a Date for a test or a replay (totpCodeOf(secret, new Date(59_000))).
• The key is written as the app shows it: upper or lower case, in groups split by spaces, with or without = padding. A character outside the base32 alphabet, or an empty key, throws a RangeError. It is your own configuration, never an answer of Instagram, so it is a defect and not a typed error.
• It uses Node's crypto only; there is no dependency.

Where the setup key comes from: Log in.