
Wondered about this.
《SMS / email delivery of a TOTP.》
I cannot see the real point of this as the number could be any random 6 digit number with a use by date ie the shared secret isn't actually shared. The 2F is really the possession of your phone or control of your email account.
TOTP is very roughly a hash of a random seed and the curent time - where the random seed is the roughly preshared key.
For very odd reasons I needed a text client to produce these tokens which given the linux oath toolkit libraries was a 20 line C program featuring the single library call:
oath_totp_generate (secret, secret_length, now, time_step_size, start_offset, digits, output_otp)
If you can get the secret out of authy generating the token is pretty simple - clients often export them as a URI possibly as a QR code eg
otpauth://totp/Okta%3A?secret=VBDASQOY366QSYRY&algorithm=SHA1&digits=6&period=30
The converting base32 encoded secret to an unsigned byte array is the only clever bit. ;)
Properly securing these totp secrets on your device/workstation is the really hard part.