title: Google Authenticator code does not match server generated code
body: <h1>Background</h1>
  
  <p><hr>
  I'm currently working on a two-factor authentication system where user are able to authenticate using their smartphone. Before the user can make use of their device they need to verify it first. For this they need to scan a QR code I give them and enter the code that subsequently shows.</p>
  
  <h1>Problem</h1>
  
  <p><hr>
  The scanning of the QR code works fine, and it gets read correctly by the Google Authenticator app. However, the generated codes don't match with the ones I'm generating on the server.</p>
  
  <h1>What have I tried</h1>
  
  <p><hr>
  I have tried a couple of things in the hope of finding my problem. </p>
  
  <ol>
  <li><p>I have tried directly inserting both a default secret:
  <code>'thiswasmysecretkeyused'</code> and a <code>base64.b32encode()</code> encoded version of the secret:
  <code>'ORUGS43XMFZW26LTMVRXEZLUNNSXS5LTMVSA===='</code> in the Google Authenticator app, but these both generated codes different from the server.</p></li>
  <li><p>I read that the trailing <code>====</code> from the key may cause it to not work, so I tried adding one without those as well. Still no good results (they generate the same codes)</p></li>
  <li><p>I have tried using a different algorithm for generating TOTP codes, for in the unlikely event that the algorithm I'm using (<a href="https://pypi.python.org/pypi/django-otp" rel="nofollow noreferrer">django-otp</a>) is incorrect. The different algorithm I used was taken from <a href="https://stackoverflow.com/a/8549884/1294864">this</a> answer. Both algorithms generated the same codes when using the same key.</p></li>
  <li><p>I checked what the time on my system was. I saw that the operating system was showing <code>15:03</code> just like my smartphone was. After dumping the time in python with both <code>time.time()</code> and <code>datetime.datetime.now()</code> I saw the returned time was one hour behind the operating system time; showing <code>14:03</code>. I tried adding <code>3600</code> seconds in to the timestamp used for code generation, but to no avail.</p></li>
  <li><p>I have tried several other things, but can't quite recall what they all were.</p></li>
  <li><p>I've looked up the code that accepts keys in Google Authenticator and have verified that it is expecting a base32 string. So my encoding of the key is correct, as far as I'm aware. From the code (<a href="https://github.com/google/google-authenticator-android/blob/master/AuthenticatorApp/src/main/java/com/google/android/apps/authenticator/EnterKeyActivity.java" rel="nofollow noreferrer">EnterKeyActivity.java</a>, line 78):</p>
  
  <blockquote>
    <p>Verify that the input field contains a valid base32 string</p>
  </blockquote></li>
  </ol>
  
  <h1>Code</h1>
  
  <p><hr>
  Generating the secret key;</p>
  
  <pre><code>def generate_shared_key(self):
      # create hash etc.
      return base64.b32encode(hasher.hexdigest())
  </code></pre>
  
  <p>Generating the QR code;</p>
  
  <pre><code>key = authenticator.generate_shared_key()
  qrcode = pyqrcode.create('otpauth://totp/someurl.nl?secret=' + key)
  </code></pre>
  
  <p>Generating the TOTP code;</p>
  
  <pre><code>def generate_code(self, drift_steps=0, creation_interval=30, digits=6, t0=0):
      code = str(totp(self.generate_shared_key(), creation_interval, timestamp, digits, drift_steps))
      return code.zfill(digits)
  </code></pre>
  
  <p>If you need any more code, such as django-otp actual totp generating code, let me know.</p>
  
  <h1>Errors</h1>
  
  <p><hr>
  No errors.</p>
  
  <h1>Hunches</h1>
  
  <p><hr>
  My hunch is that I must be going wrong somewhere with the key generation or with passing the key to Google Authenticator. Since even manually putting the key in Google Authenticator fails to generate the correct codes. Does Google Authenticator do something more with the key once it's been saved, such as adding an user?</p>
  
  <p>I also noticed in the other algorithm I used that the secret there gets decoded first with;</p>
  
  <pre><code>key = base64.b32decode(secret, True) 
  </code></pre>
  
  <p>Is my original key (a SHA512 hash) wrong? Should I or should I not encode it with <code>base64.b32encode()</code>? If I try to scan the QR code generated without encoding the hash, Google Authenticator says it does not recognize it as a (valid) key.</p>