The Riot Mobile authenticator for desktop. Local-first 2FA for your Valorant and Riot Games accounts. Riot Mobile MFA enrollment · rolling TOTP codes · one-tap push login approvals.
Authenticator is a minimal, dark, open-source Valorant / Riot Mobile authenticator desktop app for Windows that manages two-factor authentication (2FA) for Riot Games accounts: Valorant and League of Legends. It enrolls Riot Mobile MFA, generates rolling 30-second TOTP codes, and lets you approve or refuse login attempts with a single tap, all on your own machine. Your secret keys are encrypted at rest with the OS keychain and never leave your device.
> authenticator?
local-first 2fa for your riot accounts.
riot mobile mfa. totp codes. push approvals.
> features?
✓ riot mobile mfa enrollment (codes + push)
✓ approve / refuse logins right inside the app
✓ rolling 30s totp codes for every account
✓ secrets encrypted at rest (windows dpapi keychain)
✓ search · pin · reorder · rename accounts
✓ backup + restore (optional password)
✓ tray · start-on-login · global hotkey
✓ custom frameless window, dark + minimal
✓ one-click auto-updates
> install?
grab the installer and run it. per user, so no
admin prompt. windows 10/11:
https://cryba.by/auth
that page links the exact current build, so it
is never a release behind.
> build?
npm install
npm run package:win # nsis installer -> dist/
npm test # rfc 4648 / 6238 vectors
npx electron . # run without packaging
a build made this way enrolls riot mobile mfa,
generates codes and does backups. push approvals
need one more step.
> push approvals?
riot pushes login attempts to the riot mobile
android app, and google checks that app identity
when a device registers for them. so receiving
the prompts means presenting that identity, and
those values are not distributed here. read
src/push-config.cjs for the reasoning and the
six fields involved, then supply them yourself:
cp push.config.example.json push.config.json
# or set RIOT_PUSH_* in the environment
without it the app hides the approvals action
and everything else works as usual.
> release?
npm run release:win
# builds, uploads to r2 (auth.cryba.by), tags a
# github record
> updates?
built in. settings › check for updates › update.
the app reads https://auth.cryba.by/latest.json
on its own and checks the installer against the
sha256 published there before it runs anything.
> forking?
the updater defaults to auth.cryba.by, which
serves the official build, so a fork that keeps
that default replaces itself with the official
installer on its next check. change
DEFAULT_UPDATE_URL in src/main.cjs, or point
settings at your own feed. a feed publishes
version, url and the installer sha256, and
downloads that do not match it are discarded.
> security?
secret keys are encrypted at rest with the
windows dpapi keychain and never leave your
machine. updates are https only, redirects
included, and the installer is verified against
the sha256 in the feed before it is allowed to
run. SECURITY.md lists every outbound connection
the app makes, and how to report a vulnerability.
> heads up?
removing an account here won't disable mfa on
your riot account, it only stops generating
codes locally. keep a backup so you can restore
without re-enrolling.
> disclaimer?
not affiliated with, endorsed by or sponsored by
riot games. riot games, valorant and league of
legends are trademarks of riot games, inc.
this is an unofficial client for endpoints riot
does not document, so they can change or stop
working at any time. riot's terms prohibit third
party programs that "intercept, emulate, or
redirect any communication relating to the riot
services", and enrolling as a riot mobile factor
does emulate that app. so running this may breach
riot's terms and riot may act on your account.
use it on accounts you own, at your own risk.
what it does not do: read game memory, inject
code, automate play, or interfere with anti-cheat.
it enrolls as an extra mfa factor using your own
credentials, it does not bypass anyone's 2fa.
if riot asks me to change this or take it down,
i will.
> license?
mit © dancer, covering this source only. it grants
no rights in riot's trademarks, services or the
riot mobile app identity, and it is not
permission from riot to use their endpoints.