Skip to main content

Configure TOTP Authentication for an Integration

TOTP (Time-based One-Time Password) provides an additional multi-factor authentication method. When enabled, users can authenticate using a temporary code from an authenticator app like Google Authenticator, Microsoft Authenticator, or Authy.

Enable TOTP Authentication

  1. Go to the XFA Dashboard and navigate to Enforcement
  2. Click Manage on the integration you want to configure
  3. Under Multi-Factor Authentication, enable TOTP

Users will now be prompted to authenticate with a TOTP code when logging in using this integration.

Auto-approve first device

In the same Multi-Factor Authentication section, you can enable Auto-approve first device. When enabled, users skip the email verification step during their first TOTP setup and proceed directly to scanning the QR code.

How It Works

TOTP authentication generates temporary 6-digit codes that change every 30 seconds. These codes are:

  • Time-based: Synchronized with the current time
  • Device-bound: Generated locally on the user's authenticator app
  • Offline capable: No network connection required to generate codes

User Experience

First-time Setup

When a user logs in for the first time with TOTP enabled:

  1. The user selects Authenticator App as their verification method (if multiple methods are available)
  2. The user receives an email to verify their identity and must click the link to approve the device
  3. After email verification, a QR code is displayed
  4. The user scans the QR code with their authenticator app
  5. The user enters the 6-digit code to complete setup
note

If auto-approve is enabled for your organization, the email verification step (step 2) is skipped and users proceed directly to the QR code.

Subsequent Logins

On subsequent logins, users simply:

  1. Open their authenticator app
  2. Enter the current 6-digit code
  3. Complete authentication

TOTP vs Silent MFA

XFA offers two MFA methods that can be used independently or together:

FeatureTOTPSilent MFA
User interactionEnter 6-digit codeApprove request in XFA App
SetupScan QR code with authenticator appTrust device via email or XFA App
Offline supportYesNo
Device dependencyAny authenticator appXFA App required

Managing Users and Devices

As an admin, you can manage TOTP for users in the XFA Dashboard:

  1. Navigate to Devices in the XFA Dashboard
  2. Find the user in the People tab
  3. Click Reset MFA authentication to remove a user's TOTP configuration

The user will need to set up TOTP again on their next login.

Supported Authenticator Apps

Users can use any TOTP-compatible authenticator app, including:

  • Google Authenticator
  • Microsoft Authenticator
  • Authy
  • 1Password
  • Bitwarden
  • Any other RFC 6238 compliant app

For more information about the user experience with TOTP, see our user documentation.