Skip to main content

Configure TOTP Authentication for an Integration

TOTP (Time-based One-Time Password) provides an additional multi-factor authentication method. When enabled, users can authenticate using a temporary code from an authenticator app like Google Authenticator, Microsoft Authenticator, or Authy.

Enable TOTP Authentication

  1. Go to the XFA Dashboard and navigate to Enforcement
  2. Click Manage on the integration you want to configure
  3. Under Multi-Factor Authentication, switch on Enable TOTP (Time-based One-Time Password)

Users will now be prompted to authenticate with a TOTP code when logging in using this integration.

Auto-approve first device

In the same Multi-Factor Authentication section, you can enable Auto-approve first device. When enabled, users skip the email verification step during their first TOTP setup and proceed directly to scanning the QR code.

How It Works

TOTP authentication generates temporary 6-digit codes that change every 30 seconds. These codes are:

  • Time-based: Synchronized with the current time
  • Device-bound: Generated locally on the user's authenticator app
  • Offline capable: No network connection required to generate codes

User Experience

First-time Setup

When a user logs in for the first time with TOTP enabled:

  1. The user selects Authenticator App as their verification method (if multiple methods are available)
  2. The user receives an email to verify their identity and must click the link to approve the device
  3. After email verification, a QR code is displayed
  4. The user scans the QR code with their authenticator app
  5. The user enters the 6-digit code to complete setup
note

If Auto-approve first device is enabled on the integration and the user has no MFA set up yet, the email verification step (step 2) is skipped and users proceed directly to the QR code.

Subsequent Logins

On subsequent logins, users simply:

  1. Open their authenticator app
  2. Enter the current 6-digit code
  3. Complete authentication

TOTP and other MFA methods

TOTP can be used on its own or together with Silent MFA and passkeys. See MFA methods to compare them and to see which method users get when several are enabled.

Managing Users and Devices

As an admin, you can manage TOTP for users in the XFA Dashboard:

  1. Navigate to Devices in the XFA Dashboard
  2. Open the People tab and find the user
  3. Choose Reset MFA authentication from the actions menu next to the user. This removes all of the user's MFA, including TOTP

The user will need to set up TOTP again on their next login.

Supported Authenticator Apps

Users can use any TOTP-compatible authenticator app, including:

  • Google Authenticator
  • Microsoft Authenticator
  • Authy
  • 1Password
  • Bitwarden
  • Any other RFC 6238 compliant app

For more information about the user experience with TOTP, see our user documentation.