Can I sync my phone's Aegis with 2FAuth automatically?

[shalak]

From what I understand, in order to have my 2FA accounts from Aegis imported into 2FAuth, I need to manually "Export" them in Aegis.

However, Aegis supports automatic backups, which creates the Aegis JSON files - I've got that backup synced to my NAS.

Can I use those backups to automatically import the accounts into 2FAuth?

[Bubka]

Hi,

Can I use those backups to automatically import the accounts into 2FAuth?

What do you mean by automatically?
You want to know if 2FAuth can listen for new migration files (the Aegis JSON backups) in a location (your NAS) and import them without any manual action from you? Then no, you can't do that with just 2FAuth.

[shalak]

I didn't mean the feature that does exactly that. I was meaning to setup some simple cron jobs. Apologies for not being clear, what I meant is:

• do Aegis JSON backups are supported as Import items for 2FAuth?
• do 2FAuch exposes some API to import such backups?

[Bubka]

• Yes, Aegis backups are supported, as long as they are not encrypted

• Yes, you can import using the 2FAuth API, but not in a straightforward way. You need to take the following steps:
  1- POST the Aegis backup file (or its content) to the /twofaccounts/migration endpoint. The response from this endpoint is a json description of all the 2FA accounts present in the Aegis backup. You may check the id property of each account to assess its consistency. As explained in the docs:

  id = -2 means the returned account does not reflect the exact submitted data because those data are invalid or unreadable. You should not used this account definition.
  id = -1 means the returned account already exists in the authenticated user accounts in database. It's a valid account but probably useless you should discard.
  id = 0 means the returned account is successfully migrated and is valid

  2- Loop through 2FA accounts received at step 1 and POST relevant element to the /twofaccounts endpoint.

[shalak]

Hmm, the first step doesn't seem to be mandatory, am I correct? 2FAuth doesn't change its state after I call it? Given that I'll treat Aegis as single-source-of-truth, and I'll always be removing everything from 2Fauth before sync, so every time I have a clean slate, I can simply run only step 2?

[shalak]

As, I see it now. If I don't skip the -1 ones, I'd end up with duplicated entries, if I don't purge the 2FAuth... I was thinking that such call would be idempotent.

[Bubka]

Indeed, if you clean 2FAuth before each import, the first step is not mandatory. The /twofaccounts/migration endpoint doesn't change the state of 2FAuth, you can think of it as a validation step. It's not idempotent because the imported data is compared to the 2FAuth data to identify potential duplicates, and the state of 2FAut may change between 2 calls.

[shalak]

In case someone is interested, I've prepared a simple dockerized script to sync Aegis encrypted backups to 2Fauth: https://github.com/shalak/aegis-2fauth-importer

[Bubka]

Great!
Would you agree if I publish your release on social networks?

[shalak]

Sure thing, go ahead :)