I am looking for a simple Perl implementation that verifies a Google authenticator token that has been created using a server side secret. For instance,
The following Go
Would Auth::GoogleAuthenticator work for your purposes?
Edit: sure it does; this validates the OTP as generated by the JS. When the counter isn't timely anymore it returns a empty string; i.e. false. And using the URL results in the app being synced to the JS:
use Data::Printer;
use Auth::GoogleAuthenticator;
my $auth = Auth::GoogleAuthenticator->new(secret_base32 => q/e4ytonjeim4hcsrhja5fe5kqfu/);
say $auth->registration_url;
p($auth->verify('252499'));
Output:
otpauth://totp/?secret=e4ytonjeim4hcsrhja5fe5kqfu
1