Select the correct settings before you click Add to save the configuration.PyOTP - The Python One-Time Password Library You can't edit an OTP configuration after creating it.Proprietary implementations or non-standard tokens aren't supported. This feature only supports standard OTP tokens.While you can add an unlimited number of Custom TOTP factors through the Admin Console, users can only enroll in one Custom TOTP factor.If you configure a profile incorrectly, you need to re-enroll all affected users to a new custom TOTP profile. You can't edit a factor profile after creating it. This allows you to identify and fix potential issues without affecting more users. Enroll and authenticate a few users with the TOTP token before enrolling additional users. If the end user wasn’t enrolled from the API, an error message appears. If the user is enrolled from the Okta Factors API, they see a prompt to enter the passcode that appears on their security token.The user sees a prompt to authenticate with a factor when signing in to Okta or accessing an Okta-protected app, if required by sign-on policies.To add rules to the policy, see Configure an MFA enrollment policy.In Effective factors, set the TOTP option to Optional or Required.Select the policy that you want to edit, then click Edit.Set the TOTP option to Optional or Required.On the Factor Enrollment tab, add a new or edit an existing multifactor policy.Make sure you have the following information for making the API call:Įnroll Custom TOTP in an Okta multifactor policy You enter this ID when you enroll users in the Okta Factors API. To copy the Factor Profile ID for enrolling users, click the clipboard icon.The factor and associated Factor Profile ID appear. Select the algorithm that matches your implementation. If you select a time step of 15 seconds and a clock drift interval of 3, Okta accepts passcodes 15 X 3 = 45 seconds before or after a user enters their passcode. This setting allows you to build in tolerance for any drift between the token's current time and the server's current time. Select the HMAC and shared secret encoding algorithms that match your implementation: In the Admin Console, go to Security Multifactor.Provide end users with a hardware or software security token programmed with a unique shared secret.Make a note of the HMAC and shared secret encoding algorithms that you use in your implementation.Generate unique shared secrets for each user that you want to enroll in your Custom TOTP factor.If Custom TOTP isn't already enabled for your org, contact Okta Support to enable it.

Review the Okta Factors API documentation.Enroll Custom TOTP in an Okta multifactor policy.You can create unlimited instances of the Custom TOTP factor for different groups of personnel, but users may only enroll in one instance at a time. To set this factor up, you pass a factorProfileId and sharedSecret through the Okta Factors API for each token. Your users select the Custom TOTP factor when they sign in and provide the TOTP from their token to sign in to Okta or Okta-protected resources. The Custom TOTP factor lets you use a custom time-based one-time passcodes (TOTP) solution for user authentication.

Authenticator totp or hotp