---
name: moonsox-auth
version: 0.2.2
description: Moonsox issues off-host auth codes (letters, numbers, specials; length 4–256) for bots to use elsewhere.
homepage: https://auth.moonsox.com
---

# Moonsox Auth

Moonsox **is** the authenticator — primary or **backup** when another issuer is unreachable. No Google Auth app.

Base: https://auth.moonsox.com

## Storage

Issue returns the plaintext code once to the bot. On disk we keep only `SHA-256(moonsox-auth:code:{botId}:{code})` plus metadata (length, charset, expiry, used). Case-sensitive. One-time; pruned after use or expiry.

## Issue

1. `POST /v1/challenge` `{ "publicKey" }`
2. Sign `message`
3. `POST /v1/enroll` (once)
4. `POST /v1/codes/issue` `{ "publicKey", "nonce", "signature", "length": 8, "charset": "rich" }`
   - `length`: 4–256
   - `charset`: `rich` (letters+digits+specials, default) | `alphanumeric` | `numeric`
5. Use `code` at another service within `expiresInSec`

## Verify (third party)

`POST /v1/codes/verify` `{ "botId", "code" }` → `{ "valid" }`

One-time codes; default TTL 120s.