Skip to content

Set up an authenticator app

Add an authenticator app (TOTP) to your own account, so that after your password you enter the six-digit code the app shows, which changes every 30 seconds.

Who can do it

Any person who signs in, for their own account. No role or permission is needed.

The console does not offer the authenticator app when:

  • your account already holds one: an account has one authenticator app at a time;
  • the server states that no entry you make with your own authenticators admits a password with an authenticator app (the inventory says totpEnrolmentAdmitted: false);
  • you are acting in a tenant under support access: the Security item is absent from the account menu;
  • your session came from your organization's identity provider and the platform holds no credential for you.

Before you start

  • Have an authenticator app on your phone or another device.
  • An authenticator app is not phishing-resistant. Where a tenant requires a phishing-resistant authenticator, add a passkey instead.

Steps

  1. Open the account menu in the header and select Security.
  2. Under Passkeys and authenticator app, find Add an authenticator app and select Set up an authenticator app.
  3. If Confirm your identity to continue opens, confirm with your own sign-in steps.

  4. Add the account to your app, in one of three ways:

    • scan the QR code with the app;
    • type the Setup key into the app, or select Copy key;
    • on the device that holds the app, select Open in authenticator app.

    The key is shown only once.

  5. In Code from your authenticator app, enter the code the app shows now and select Verify.

  6. If this is your first passkey or authenticator app, the console shows Save your recovery codes. Store them safely, select I have saved these codes somewhere safe, then Done.

What you see when it worked

The console says "Authenticator app added." and the list shows an entry of kind "Authenticator app", listed as not phishing-resistant. Add an authenticator app is no longer offered. The change is listed under Recent security activity.

If it fails

What you see Cause What to do
"That code is not valid. Enter the code the app shows now." The code was wrong or expired; the setup stays open Enter the code the app shows now
"Enter the code as 6 to 8 digits." The code is not 6 to 8 digits Correct the code
"This change requires you to confirm your identity again. Nothing was changed." The confirmation was closed or did not succeed Start again and confirm your identity
"Your identity is confirmed. Enter your password or code again and submit once more; nothing was changed." You confirmed your identity while the code was being sent; a code is never sent twice for you Enter the code again and select Verify
"The change was not made" with the server's reason The server refused the enrolment Read the reason; where an authenticator app is not admitted, add a passkey instead

Select Cancel to abandon the setup; nothing is added.

Without the console

Surface How
API POST /api/v3/auth/account/authenticators/totp (operation createTotpEnrolment), then POST /api/v3/auth/account/authenticators/totp/verification with the code as otp (operation verifyTotpEnrolment)
  • Security: what the screen shows and every decision you make on it.