totp-provider-api

Get a code from a provider that holds the seed for you. The machine running the agent never has the secret, the provider logs every request, and access is revoked by disabling a token rather than by chasing files. Fixes the failure that wastes the most time here: a vendor CLI silently falling back to an interactive unlock, so an unattended job hangs until it is killed.

Which skill, in one question

Do you hold the seed? If yes — a file, keychain entry, or otpauth:// URI on this machine — that is totp-generate plus totp-secret-store. If the seed lives in a vault you authenticate to and never see, it is this skill. op item get --otp computes locally inside the op binary, but you never hold the seed, so it is here.

When NOT to use