Set up an authenticator app (TOTP)

An authenticator app generates six-digit codes that change every 30 seconds. It serves as a second step after your password, for Windows and for the VPN, and it holds the Windows offline codes. It does not replace a passkey.

Before you start

• You can turn one-time codes on only if you already have a strong factor (passkey or approver phone): the console asks for a recent confirmation.
• Each account has at most one of these methods at a time: TOTP, HOTP or OCRA.
• A session started with a password and a code only gives access to the «Protect» area.

How do I set it up?

1. Open «Protect» › «Trusted devices» and choose «One-time codes».
2. Choose «TOTP · time-based», then «Start setup». Confirm when the console asks.
3. In «1. Add to the generator», scan the QR with your authenticator app. On the same device, use «Copy key» or «Copy link». The parameters are «SHA-1 · 6 digits · 30 s». The secret is shown only this once.
4. In «2. Confirm the code from the app», type the current code and choose «Confirm and activate».
5. The console confirms the method is active and that a password alone is no longer enough. Sessions started with a password alone end.

Do not share the QR or a screenshot of this screen: whoever has it can generate your codes.

The code is not accepted

The console shows «The code was not accepted. Check the time in the app and enter a new code.» It is almost always the phone's clock: turn automatic time on. See Clock out of sync.

If the time runs out before you confirm, «The setup expired. No activation was assumed.» appears. Start again.

How do I remove it?

In the same dialog, type REMOVE in the confirmation field and choose «Remove one-time code». Sessions created with that method are revoked.

Lockouts after wrong codes

From the fifth wrong code in a row, the method pauses for one minute, and the pause doubles with each new failure, up to an hour. A right code resets the count.