What it is
Token2 keys can store OATH-style OTP entries directly on a hardware applet, read over CCID/NFC or USB-HID. Unlike an authenticator app, the seeds are sealed on the secure element: keyroost provisions them with an encrypted write and reads live codes, but the secret material cannot be exported.
Adding & reading codes
In the On-device OTP tab, choose Add credential, then enter the issuer, account and Base32 secret and pick TOTP (time-based) or HOTP (counter-based), the algorithm, digits, and — for TOTP — the period (commonly 30 or 60 seconds). TOTP entries show a live code with a countdown ring that refreshes when the window rolls over. Entries marked require touch show a Read button — press it and touch the key to reveal the code.
HID-HOTP (HOTP-on-touch)
HID-HOTP is a single dedicated slot that makes the key act like a keyboard: touch it outside any session and it types a fresh HOTP code wherever your cursor is — handy for systems that accept a typed one-time code.
HID-HOTP types over the key's keyboard (HID) interface, so that interface must be enabled. keyroost shows an Enable HID-HOTP / Disable HID-HOTP control; toggling it reconfigures the key's USB interfaces and needs a re-plug to take effect. keyroost refuses any change that would leave fewer than two interfaces enabled, so you can't lock yourself out.
Provisioning
Open the HID-HOTP form, enter the Base32 secret, choose 6 or 8 digits, and set the typing options: Send Enter (append Return), Long touch (require a 2-second press), Numeric keypad (type with keypad scancodes). Save, and the card shows the slot as configured.
Changing options without re-entering the seed
Once a seed is provisioned you can change the typing options without re-entering the secret: open the form and use Update options only. The seed slot is left untouched. To replace the seed, enter a new secret and Save; to remove it, use Clear slot.
Command line
keyroostctl otp config # interface states & slot status
keyroostctl otp interface --fido --ccid --keyboard # enable interfaces (re-plug after)