From 9b13cf21520bf06e0d545964414b10cc9bdd13e0 Mon Sep 17 00:00:00 2001
From: Anton Afanasyeu <a.afanasieff@gmail.com>
Date: Sun, 12 Jul 2026 14:21:10 +0200
Subject: [PATCH] Use server-side branded QR data URIs for TOTP fallback
 images.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 src/AuthTotp.php | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/AuthTotp.php b/src/AuthTotp.php
index 8656ed0..5c90510 100644
--- a/src/AuthTotp.php
+++ b/src/AuthTotp.php
@@ -20,6 +20,12 @@ final class AuthTotp {
     }
 
     public static function qrImageUrl(string $otpauthUri, int $size = 200): string {
+        if (class_exists('QrBrandedRenderer', false)) {
+            $dataUri = QrBrandedRenderer::dataUri($otpauthUri, $size);
+            if ($dataUri !== null) {
+                return $dataUri;
+            }
+        }
         return 'https://api.qrserver.com/v1/create-qr-code/?size=' . $size . 'x' . $size
             . '&data=' . rawurlencode($otpauthUri);
     }