---
title: Time-based one-time password \(TOTP\) authentication
description: A time-based one-time password \(TOTP\) is a secure authentication factor that verifies user identity by generating a unique, time-sensitive code.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/platform-security/authentication/totp-authenticator-apps.html
release: brazil
product: Authentication
classification: authentication
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [Time-based one-time password, TOTP, authenticator apps, ServiceNow, user authentication, authentication factor, Okta Verify]
breadcrumb: [Authentication factor configuration for AI voice agents, Authentication factors, Authentication, Access Management]
---

# Time-based one-time password \(TOTP\) authentication

A time-based one-time password \(TOTP\) is a secure authentication factor that verifies user identity by generating a unique, time-sensitive code.

TOTP authenticator apps like **Okta Verify** generate temporary numeric codes on a registered device, usually a mobile phone. These codes are only valid for a short time and can’t be used more than once. This approach offers enhanced security compared to static passwords.

## Use case

TOTP authenticator apps are suitable for users who require stronger protection than standard multi-factor authentication \(MFA\) methods. TOTP factor can also be used for step-up authentication. For more information, see [Step-up authentication](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/platform-security/authentication/step-up-authentication.md).

## Key strengths

The TOTP authenticator apps method offers the following advantages:

-   Local generation: One-time passwords are generated directly on the user's device and don’t require an internet or mobile network connection.
-   Security: TOTP is resistant to interception and SIM-swapping attacks, providing robust protection for the authentication process.

## Important considerations

The following considerations apply to TOTP authenticator apps:

-   Initial setup: Users must set up the authenticator app on a registered device.
-   Device management: Users must re-enroll when devices are replaced or reset.
-   Phishing risk: One-time codes can be compromised if entered on untrusted or malicious sites.

TOTP authenticator apps can help strengthen your organization’s security posture. For detailed configuration instructions, see [Authenticator applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/platform-security/authentication/mfa-auth-app.md).