Open and send data to authentication app from website

Question

What is the question?

Would it be possible to send otp setup info (name, secret) to the installed authentication app (Google authenticator or Authy) via a universal link or something else?

What is the goal here?

Imagine this scenario where user wants to activate the 2FA on a website.
The available options are that:

1. User copy the secret and then paste it into the auth app
2. User scan the QR code with the auth app

However, we want a third option, where the user just clicks a button and the authentication app opens up automatically with prefilled data.

Requirements of the perfect solution

1. It must works on both android and ios (If it works on desktop as well, it would be awesome)
2. Preferably it should work for both Google authenticator and Authy
3. Preferably it shouldn't be limited to PWA websites

Almost a similar question for android

Intent to Open Google Authenticator

Answer 1

Twilio developer evangelist here.

I don't believe there is a way to open Google Authenticator from a web application. I haven't tried, but perhaps linking to the otpauth:// URL that you use for the QR code would trigger an authenticator application. However it would be a broken link for users that don't have an authenticator application installed.

With Authy, when you register a user with the Authy API using their phone number and email address, if they have the Authy application then your application will be added without them having to do anything. Then when you request a one time password from them they will receive a push notification which, when tapped, will open the Authy application on the one time password for your application.

Further, you can implement push authentications with the Authy API which send a push notification and when opened give the user the option to approve or deny the authentication without having to copy across the OTP.

We can do this with the Authy application and the Authy API because of the tight integration between the two. Google Authenticator does not provide such an integration.

Note that in the case where the user doesn't already have the Authy application installed, the verification codes fallback to delivery over SMS.