Home

Viscosity OTP automates One-Time Password entry for Viscosity VPN connections on macOS. When you connect, your OTP is fetched and submitted automatically — no manual copy-paste required.

How It Works

Viscosity 1.10.5+ (blog/release note) supports challenge response in Before Connect scripts. This project provides a single AppleScript (BeforeConnect.applescript) that:

1. Reads the VPN connection name from Viscosity
2. Looks up a shell command mapped to that connection in macOS preferences
3. Runs the command to fetch the OTP
4. Returns challenge <OTP> to Viscosity, which submits it automatically

Provider Agnostic

Any CLI tool that outputs a TOTP code will work:

• 1Password — op item get <uuid> --otp
• Bitwarden — bw get totp <item>
• KeePassXC — keepassxc-cli show -t <db> <entry>
• oathtool — oathtool --totp --base32 <secret>
• Or any custom script/command

Quick Start

1. Map a connection to an OTP command:

defaults write net.skycmd.viscosity-otp "<connection-name>" "<otp-command>"

2. Point Viscosity to the script:

Open Viscosity Preferences → select the connection → Advanced → set Before Connect Script to BeforeConnect.applescript.

That's it. Next time you connect, the OTP is handled for you.

Wiki Contents

• Installation — downloading and placing the script
• Configuration — setting up OTP commands for your connections
• Providers — detailed guides for 1Password, Bitwarden, KeePassXC, and more
• Troubleshooting — common issues and how to resolve them
• Known Limitations — macOS TCC prompts and other caveats

Links

• Running AppleScripts When Connected/Disconnected