Queye logo Queye Help

Help Center / API

Add a Queye Authenticator button to your website

API Updated 2026-09-23

Providers can let customers add a TOTP code to Queye Authenticator with an embeddable button. The button is a small JavaScript embed: you do not need to build a provider integration or call an API.

Add the embed

Include the customer's otpauth://totp/... provisioning URI in data-otpauth, then place the placeholder where the button should appear:

<script defer
        src="https://authenticator.queye.co/add/button.js"
        data-otpauth="otpauth://totp/Example%3Aalice?secret=BASE32SECRET&amp;issuer=Example"></script>

<span id="queye-authenticator-button"></span>

This works in static HTML and server-rendered pages. If the placeholder is omitted, the script inserts the button after itself.

Language

Set the script's lang attribute to choose the button language, for example lang="fr". If it is omitted, the script uses the page's <html lang>, then the visitor's browser language, then English. The product name stays “Queye Authenticator”; the action text is localized and can appear before or after the name.

What happens when a customer clicks

  1. The button requests a compact popup to open the Queye Authenticator add page. If popups are blocked, the link opens in a new tab. The browser may choose the size and whether to use a tab or window.
  2. The customer signs in and unlocks their Queye Authenticator keychain.
  3. Queye Authenticator shows a consent prompt with the service and account name. The customer chooses Add or Not now.
  4. The add page attempts to close. When the popup closes, the original button removes its text and shows a tick. A browser-opened fallback tab cannot report its close state.

Requirements and security

  • Provide a valid TOTP provisioning URI with the account, issuer, and Base32 secret. HOTP is not supported.
  • Generate the URI for the customer who is enrolling, and do not expose it to other users.
  • The URI and generated add link contain the TOTP secret. The link reaches the Authenticator web server and may appear in access logs. Use HTTPS, restrict log access and retention, and avoid long-lived links.
  • The embed does not send the secret to your server; your page already has the secret to create the TOTP URI.

Troubleshooting

  • No button: check that the script loaded, the data-otpauth value is a valid TOTP URI, and the page contains the exact placeholder ID.
  • The add page does not load: confirm the visitor has an internet connection and JavaScript is enabled, then check for content security policy rules blocking authenticator.queye.co.
  • The popup is large or opens as a tab: popup dimensions and presentation are controlled by the browser and the visitor's settings.