title: How do I generate the correct TOTP with Node with correct Headers and SHA512 hashed Token?
body: <p>A recent school project I was assigned has a coding challenge we have to complete. The challenge has multiple parts, and the final part is uploading to a private GitHub repo and submitting a completion request by making a POST request under certain conditions.</p>
  
  <p>I have successfully completed the other parts of the challenge and am stuck on submitting the request. The submission has to follow these rules:</p>
  
  <blockquote>
    <p><strong>Build your solution request</strong></p>
    
    <p>First, construct a JSON string like below:</p>
    
    <p><code>{</code></p>
    
    <p>&nbsp;&nbsp;&nbsp;&nbsp;<code>"github_url": "https://github.com/YOUR_ACCOUNT/GITHUB_REPOSITORY",</code></p>
    
    <p>&nbsp;&nbsp;&nbsp;&nbsp;<code>"contact_email": "YOUR_EMAIL"</code></p>
    
    <p><code>}</code></p>
    
    <p>Fill in your email address for <code>YOUR_EMAIL</code>, and the private Github repository with your solution in <code>YOUR_ACCOUNT/GITHUB_REPOSITORY</code>.
    Then, make an HTTP POST request to the following URL with the JSON string as the body part.</p>
    
    <p><code>CHALLENGE_URL</code></p>
    
    <p><strong>Content type</strong></p>
    
    <p>The Content-Type: of the request must be <code>application/json</code>.</p>
    
    <p><strong>Authorization</strong></p>
    
    <p>The URL is protected by HTTP Basic Authentication, which is explained on Chapter 2 of RFC2617, so you have to provide an Authorization: header field in your POST request.</p>
    
    <ul>
    <li>For the userid of HTTP Basic Authentication, use the same email address you put in the JSON string.</li>
    <li>For the password , provide a 10-digit time-based one time password conforming to RFC6238
    TOTP.</li>
    </ul>
    
    <p><strong>Authorization password</strong></p>
    
    <p>For generating the TOTP password, you will need to use the following setup:</p>
    
    <ul>
    <li>You have to generate a correct TOTP password according to RFC6238 </li>
    <li>TOTP's <code>Time Step X</code> is 30 seconds. <code>T0</code> is 0.</li>
    <li>Use <code>HMAC-SHA-512</code> for the hash function, instead of the default <code>HMAC-SHA-1</code>.</li>
    <li>Token shared secret is the userid followed by ASCII string value <code>"APICHALLENGE"</code> (not including double quotations).</li>
    </ul>
    
    <p><strong>Shared secret examples</strong></p>
    
    <p>For example, if the userid is <code>"email@example.com"</code>, the token shared secret is <code>"email@example.comAPICHALLENGE"</code> (without quotes).</p>
    
    <p>If your POST request succeeds, the server returns HTTP status code 200 .</p>
  </blockquote>
  
  <p>I have tried to follow this outline <strong>very</strong> carefully, and testing my work in different ways. However, it seems I can't get it right. We are supposed to make the request from a Node server backend. This is what I have done so far. I created a new npm project with <code>npm init</code> and installed the dependencies you will see in the code below:</p>
  
  <pre><code>const axios = require('axios');
  const base64 = require('base-64');
  const utf8 = require('utf8');
  
  const { totp } = require('otplib');
  
  
  const reqJSON = 
  {
      github_url: GITHUB_URL,
      contact_email: MY_EMAIL
  }
  const stringData = JSON.stringify(reqJSON);
  
  const URL = CHALLENGE_URL;
  const sharedSecret = reqJSON.contact_email + "APICHALLENGE";
  
  totp.options = { digits: 10, algorithm: "sha512" }
  
  const myTotp = totp.generate(sharedSecret);
  const isValid = totp.check(myTotp, sharedSecret);
  
  console.log("Token Info:", {myTotp, isValid});
  
  
  
  
  const authStringUTF = reqJSON.contact_email + ":" + myTotp;
  const bytes = utf8.encode(authStringUTF);
  const encoded = base64.encode(bytes);
  
  
  
  const createReq = async () =&gt;
  {
  
      try 
      {
  
          // set the headers
          const config = {
              headers: {
                  'Content-Type': 'application/json',
                  "Authorization": "Basic " + encoded
              }
          };
  
          console.log("Making req", {URL, reqJSON, config});
  
          const res = await axios.post(URL, stringData, config);
          console.log(res.data);
      }
      catch (err)
      {
          console.error(err.response.data);
      }
  };
  
  createReq();
  </code></pre>
  
  <p>As far as I understand, I'm not sure where I'm making a mistake. I have tried to be very careful in my understanding of the requirements. I have briefly looked into all of the documents the challenge outlines, and gathered the necessary requirements needed to correctly generate a TOTP under the given conditions.</p>
  
  <p>I have found the npm package <code>otplib</code> can satisfy these requirements with the options I have passed in.</p>
  
  <p>However, my solution is incorrect. When I try to submit my solution, I get the error message, <code>"Invalid token, wrong code"</code>. Can someone please help me see what I'm doing wrong?</p>
  
  <p>I really don't want all my hard work to be for nothing, as this was a lengthy project.</p>
  
  <p>Thank you so much in advance for your time and help on this. I am very grateful.</p>