HOTP and OCRA tokens (counter and challenge)

Besides TOTP (time-based), the console accepts two less common generator types, usually hardware tokens your organization provides. Like TOTP, they are always a lower-assurance second step.

Which types are there?

How do I set up HOTP?

1. Open «Protect» › «Trusted devices» › «One-time codes» and choose «HOTP · counter-based».
2. Choose «Start setup» and confirm with your passkey or phone.
3. Set up the token with the key shown and confirm the first code.

Each accepted code advances the counter and cannot be reused.

My HOTP is no longer accepted

Pressing the token's button without using the codes moves its counter ahead. The console shows «The code was not accepted. Generate the next code on the token and try again.» If it continues, resynchronize:

1. In the same dialog, use «Resynchronize the counter».
2. Generate two consecutive codes on the token, without using any other in between, and type them in «First code» and «Second code».
3. Choose «Resynchronize HOTP». The search looks up to 100 positions ahead.

After resynchronizing, previous password sessions are revoked.

How do I use OCRA?

At sign-in, the page shows a verification question. Enter it in the generator and type only the 8-digit response. If «The response was not accepted. Confirm the suite, the key and the question before generating another response.» appears, check the generator's setup.

Can I have TOTP and HOTP at the same time?

No. Each account has at most one of these methods at a time. To switch, remove the current one and set up the new one.