Core FeaturesIntegrations

TOTP Authentication

Overview

Time-based One-Time Password (TOTP) is a secure authentication mechanism used as part of multi-factor authentication (MFA). It generates a temporary, one-time password based on a shared secret and the current time. Each OTP is valid only for a short duration, reducing the risk of replay attacks and unauthorized access.

Configuration

The Configuration section lets you define the behavior of TOTP for a specific tenant. These settings apply to all users and authentication flows associated with the tenant.

::: You must first navigate to Integrations → Verification → Fyno TOTP before you can configure TOTP settings. :::

This pop-up window allows you to configure OTP generation and verification rules for a tenant or application. These settings define how OTPs are created, how long they remain valid, and how strictly they are verified during user authentication and activation.

TOTP Settings

Field NameRequiredDescriptionHelper / Notes
Tenant NameYesA unique name to identify the application or tenant for which TOTP is configured.Used to distinguish multiple TOTP configurations.
AlgorithmYesCryptographic algorithm used to generate OTPs by encoding plaintext into ciphertext.
Characters/digitsYesNumber of digits in the generated one-time password.Must be between 6 and 9 digits.
Generation PeriodYesTime interval after which a new OTP is generated.Common value: 30 seconds
Verification PaddingYesNumber of previous OTP intervals accepted during verification to handle clock drift.0 = only current OTP is valid
Verification CountYesNumber of OTP verifications required during user activation.None = no additional verification required
Toggle OptionNoAllows users to scan a QR code using third-party authenticator apps such as Google Authenticator or Authy.—

NOTE:

When this QR code toggle is Enabled:

  • The system generates a QR code for the user during TOTP setup.
  • Users can scan this QR code using third-party authenticator apps.
  • The authenticator app is automatically configured with the correct account and secret.
  • This makes setup faster, easier, and less error-prone for users.
  • Users do not need to manually enter any secret key.

When this QR code toggle is Disabled:

  • No QR code is shown during TOTP setup.
  • Users must manually enter the secret key into their authenticator app.
  • This is more manual and may increase the chance of configuration errors.
  • This mode is useful in environments where QR codes are not allowed for security or policy reasons.

Once the configuration is saved, a Tenant ID is generated. This system-generated identifier is required to associate authentication requests with the configured TOTP rules.

System Fields

These fields are system-generated or system-managed and cannot be directly edited by the user.

Field NameTypeDescription
Tenant IDIdentifierA unique system-generated identifier created after saving the configuration. Used to associate OTP requests with this tenant.