multiauth-cli

Battle.net authenticator in your terminal. Enroll, generate 2FA codes, never need the phone app.

$ node src/cli.js code
48291035  (22s remaining)

Quick Start

git clone https://github.com/vitalio-sh/multiauth-cli.git && cd multiauth-cli

# Enroll a new authenticator (one-time setup)
node src/cli.js enroll

# Generate codes on demand
node src/cli.js code

Zero dependencies. No npm install. Just Node.js 20+.

Why

WinAuth was archived in 2019. The Blizzard Authenticator mobile app is the only official option. This tool gives you a scriptable, terminal-native alternative — enroll once, get codes forever.

Enrollment Flow

Enrollment requires a one-time browser login to link the authenticator to your Battle.net account:

$ node src/cli.js enroll

To enroll, you need to log into Battle.net in your browser.

Steps:
  1. Open this URL in your browser:
     https://account.battle.net/login/en/?ref=localhost

  2. Log in with your Battle.net credentials

  3. After login, the page will redirect to http://localhost/...
     The page will FAIL to load — that is expected!
     Copy the FULL URL from your browser address bar.

Paste the redirect URL (or just the ST token): US-xxxxxxxxxxxx...
Exchanging SSO token for OAuth access...
Enrolling authenticator with Blizzard...
Passphrase (empty for no encryption):

=== Enrollment Successful ===
Serial:       XX-XXXX-XXXX-XXXX
Restore Code: XXXXXXXXXX
Region:       US

Current code: 48291035 (expires in 28s)

Save your Serial and Restore Code. You need both to recover your authenticator if you lose the credentials file.

Then attach it to your account:

1. Go to Battle.net Account Security > Add Authenticator
2. Choose "Have a physical authenticator?"
3. Enter your Serial Number and a fresh code from node src/cli.js code

Commands

Command	Description
enroll	Register a new authenticator (one-time browser login)
code	Generate current 8-digit TOTP code
info	Show serial, region, restore code (never the secret)
sync	Re-sync clock with Blizzard servers
restore	Recover authenticator from serial + restore code

Security

• Secret key is never printed or logged — only the generated TOTP code is shown
• Credentials file supports AES-256-CBC encryption with a user passphrase (PBKDF2, 100K iterations, SHA-256)
• Credentials are stored locally in data/authenticator.json (gitignored)
• No telemetry, no network calls except to Blizzard's API

How It Works

src/
  cli.js            CLI entry point
  authenticator.js  HMAC-SHA1 TOTP (8 digits, 30s period)
  enrollment.js     Blizzard OAuth + REST API
  restore.js        Restore code computation (SHA-1, custom alphabet)
  store.js          PBKDF2 + AES-256-CBC credential storage

The TOTP algorithm is standard RFC 6238 with Battle.net-specific parameters: HMAC-SHA1, 8-digit codes (not 6), 30-second period, 20-byte secret. Enrollment uses Blizzard's current REST API (authenticator-rest-api.bnet-identity.blizzard.net) via OAuth SSO.

Troubleshooting

Codes rejected? Run node src/cli.js sync — clock drift is the most common cause.

SSO token not found? The redirect URL must contain ?ST=.... Make sure you used the login link with ?ref=localhost. The localhost page failing to load is expected — just copy the URL.

Token expired? SSO tokens are short-lived. Re-run the login flow to get a fresh one.

License

GPL-3.0 — Based on WinAuth by Colin Mackie.