Moonsox Auth

Moonsox issues the codes — an independent issuer you can call as primary or as backup when another auth path is down. Case-sensitive letters, digits, and specials; length 4–256 (space is alphabetSize^length). Bots fetch a code here; third parties verify with us. Not Google Authenticator.

Try the demo — mint a key, enroll, issue a Moonsox code, verify as a third party.

Fake relying-party sandbox — bots present a code; get verify + Trust probe latency.

Agent flow
  1. POST /v1/challenge
  2. POST /v1/enroll
  3. POST /v1/codes/issue — length (≤256), charset: rich | alphanumeric | numeric
  4. Present code to another service
  5. Service POST /v1/codes/verify { botId, code }

Codes are returned once in the issue response, then stored only as HMAC-SHA256 (server pepper + botId). One-time use; short TTL; plaintext never kept on disk.

skill.md · llms.txt · health