Serving rotating 2FA codes to a shop without leaking the secret
When fulfilment depends on a code that changes every thirty seconds, reading it off a phone does not scale. How to expose current codes to a shop and its operators without spreading the TOTP secret across the system.