Time-based one-time password \(TOTP\) authentication

concept brazil Updated Sep 10, 2026 1 min read totp-authenticator-apps.md

A time-based one-time password (TOTP) is a secure authentication factor that verifies user identity by generating a unique, time-sensitive code.

TOTP authenticator apps like Okta Verify generate temporary numeric codes on a registered device, usually a mobile phone. These codes are only valid for a short time and can’t be used more than once. This approach offers enhanced security compared to static passwords.

Use case

TOTP authenticator apps are suitable for users who require stronger protection than standard multi-factor authentication (MFA) methods. TOTP factor can also be used for step-up authentication. For more information, see Step-up authentication.

Key strengths

The TOTP authenticator apps method offers the following advantages:

Local generation: One-time passwords are generated directly on the user's device and don’t require an internet or mobile network connection.
Security: TOTP is resistant to interception and SIM-swapping attacks, providing robust protection for the authentication process.

Important considerations

The following considerations apply to TOTP authenticator apps:

Initial setup: Users must set up the authenticator app on a registered device.
Device management: Users must re-enroll when devices are replaced or reset.
Phishing risk: One-time codes can be compromised if entered on untrusted or malicious sites.

TOTP authenticator apps can help strengthen your organization’s security posture. For detailed configuration instructions, see Authenticator applications.

Keywords Time-based one-time passwordTOTPauthenticator appsServiceNowuser authenticationauthentication factorOkta Verify

43 lines · 2.6 KB Wrap lines

---
title: Time-based one-time password \(TOTP\) authentication
description: A time-based one-time password \(TOTP\) is a secure authentication factor that verifies user identity by generating a unique, time-sensitive code.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/platform-security/authentication/totp-authenticator-apps.html
release: brazil
product: Authentication
classification: authentication
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [Time-based one-time password, TOTP, authenticator apps, ServiceNow, user authentication, authentication factor, Okta Verify]
breadcrumb: [Authentication factor configuration for AI voice agents, Authentication factors, Authentication, Access Management]
---

# Time-based one-time password \(TOTP\) authentication

A time-based one-time password \(TOTP\) is a secure authentication factor that verifies user identity by generating a unique, time-sensitive code.

TOTP authenticator apps like **Okta Verify** generate temporary numeric codes on a registered device, usually a mobile phone. These codes are only valid for a short time and can’t be used more than once. This approach offers enhanced security compared to static passwords.

## Use case

TOTP authenticator apps are suitable for users who require stronger protection than standard multi-factor authentication \(MFA\) methods. TOTP factor can also be used for step-up authentication. For more information, see [Step-up authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/platform-security/authentication/step-up-authentication.md).

## Key strengths

The TOTP authenticator apps method offers the following advantages:

- Local generation: One-time passwords are generated directly on the user's device and don’t require an internet or mobile network connection.
- Security: TOTP is resistant to interception and SIM-swapping attacks, providing robust protection for the authentication process.

## Important considerations

The following considerations apply to TOTP authenticator apps:

- Initial setup: Users must set up the authenticator app on a registered device.
- Device management: Users must re-enroll when devices are replaced or reset.
- Phishing risk: One-time codes can be compromised if entered on untrusted or malicious sites.

TOTP authenticator apps can help strengthen your organization’s security posture. For detailed configuration instructions, see [Authenticator applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/platform-security/authentication/mfa-auth-app.md).