# 4.12.8 Time-based OTP (TOTP)  Authentication

*A Time-based One-time Password (TOTP) is a time-sensitive code used in two-factor authentication (2FA) to provide an extra layer of security for online accounts. It's generated by an algorithm that combines a shared secret key and the current time to produce a unique, short-lived code, displayed in the ZTrust authenticator app.*

To configure the TOTP Authentication, follow the below steps -

1. Go to the **Authentication** tab in the sidebar.\\

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FT9adyjoiiuEeLvhpfdxI%2FScreenshot%202025-09-08%20221549.png?alt=media&#x26;token=72d61e06-724f-4899-bdbe-c6d28f3f921d" alt=""><figcaption><p>Fig. 4.12.8.a: Navingating to Authentication section</p></figcaption></figure>

2. Click on the **kebab menu (three dots)** on the right side of the browser flow. Select **Duplicate**. A popup will appear.\\

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F9cTOhZ0fJXLsqjJMUSP1%2FScreenshot%202025-09-08%20223201.png?alt=media&#x26;token=1999d172-3d19-4fd1-baeb-fae3b73a44bf" alt=""><figcaption><p>Fig 4.12.8.b: Duplicating the existing browser flow</p></figcaption></figure>

3. Provide a **Name** for the flow, "Time based OTP". Click **Duplicate**. You will be redirected to the new flow configuration.

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2Fsh0OBEpupwQuEGYgy1v7%2Fimage.png?alt=media&#x26;token=6a2fcce5-21cb-4fdd-a4ce-6817f07624f4" alt=""><figcaption><p>Fig 4.12.8.c: Giving a name to the new browser flow for TOTP login</p></figcaption></figure>

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2Fwacq7CiVBVF7H6XDDkqk%2Fimage.png?alt=media&#x26;token=226580f2-2605-48a6-94eb-d26f9f812d36" alt=""><figcaption><p>Fig 4.12.8.d: Duplicated browser flow configuration page for TOTP login</p></figcaption></figure>

4. Delete everything under **Time based OTP forms**.\\

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F1UDCNkGYDfvkvPAuV3Qq%2Fimage.png?alt=media&#x26;token=0c24fced-c395-4d27-8083-716acafe5716" alt=""><figcaption><p>Fig 4.12.8.e.a: TOTP browser flow configuration page before deleting executions</p></figcaption></figure>

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FAkpwGwiRu9ylLBfY7Qzv%2Fimage.png?alt=media&#x26;token=368179c9-27b6-4335-95c1-75a356381ec3" alt=""><figcaption><p>Fig 4.12.2.e.b: TOTP browser flow configuration page after deleting executions</p></figcaption></figure>

5. Click on the **plus** icon on the right side of the **Time based OTP forms**. Select **Add Execution**. A popup will appear to select an execution.\\

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FaUTFV9DLzSlujFWBin6I%2Fimage.png?alt=media&#x26;token=dfb5d1c5-6a2b-4e49-be6b-51ac2fcbfc04" alt=""><figcaption><p>Fig 4.12.8.f: Proceeding to add a new execution to TOTP login flow</p></figcaption></figure>

6. Search for **Advanced Token Authenticator**, select it and click **Add**.

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FR4e1M8aH8eFC0pseTg18%2Fimage.png?alt=media&#x26;token=d8d9002e-d60d-4d7d-ac96-fefaa09274ae" alt=""><figcaption><p>Fig 4.12.8.g: Select 'Advanced Token Authenticator' execution to add</p></figcaption></figure>

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FCSQPeEFD676V4oUu6cIo%2Fimage.png?alt=media&#x26;token=1d324b27-4817-432e-9fdd-4716db728053" alt=""><figcaption><p>Fig 4.12.8.h: Added TOTP login execution</p></figcaption></figure>

7. Click on the **settings menu (gear icon)** on the right side of the **Advanced Token Authenticator**. A popup will appear to configure the TOTP settings.\\

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FNNE1YmWSSH0tzytHuWIh%2Fimage.png?alt=media&#x26;token=7102ac45-bc15-47e9-a5c0-82bb02f450a2" alt=""><figcaption><p>Fig 4.12.8.i: Proceeding to configure TOTP login</p></figcaption></figure>

8. Provide an **Alias**. Set **Number of digits in Token code, Token Code period(in seconds), Secure Key** and click **Save**.\\

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F8o9hxLIKvjzDF8cX1D7b%2Fimage.png?alt=media&#x26;token=65ce8d94-f66f-414e-935b-df99a87cb2f6" alt=""><figcaption><p>Fig 4.12.8.j: Configuring TOTP login</p></figcaption></figure>

9. Change **Requirement** of the Advanced Token Authenticator from **Disabled** to **Required**. This will set the flow to be executed when the flow is activated.\\

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FQFlqdrYms0KJ94B8r3cY%2Fimage.png?alt=media&#x26;token=e73df80a-a212-41fd-b58d-33c932823159" alt=""><figcaption><p>Fig 4.12.8.k: Changing the 'Requirement' of TOTP login</p></figcaption></figure>

10. Click on the **Actions**, on the top right of the page, and then **Bind flow**. A popup will appear.\\

    <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FYKVQ6c8AnRaW0bp3KpvA%2Fimage.png?alt=media&#x26;token=e9c96895-60fa-4056-a3f3-55b81953c2a7" alt=""><figcaption><p>Fig 4.12.8.l: Proceeding to bind the TOTP login flow</p></figcaption></figure>

11. Select the **Browser flow** as the **binding type** and click **Save**.\\

    <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FypPpYQ6zRzhmu5Dg3Tuo%2Fimage.png?alt=media&#x26;token=494d8070-ea94-47cf-91a6-a1553450fb2c" alt=""><figcaption><p>Fig 4.12.8.m: Selecting a flow to bind TOTP login to</p></figcaption></figure>

The Time-based OTP Authentication is enabled now.\\
