---
sourceDocument: Australia Workflow Data Fabric
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/integrate-applications

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Workflow Data Fabric

ft:clusterId :

    - crint

bundleId :

    - crint

workflow :

    - Creator


---

# TOTP authentication

# TOTP authentication in RPA Hub {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
You can configure the Time-based One-time Password (TOTP) fields in RPA Hub that enable the unattended robots to seamlessly authenticate against
multi-factor authentication (MFA)-enabled applications.

## Overview of TOTP authentication

An authenticator application is third-party software that generates temporary passcodes. Users can use these passcodes with their password to log in into an instance that requires multi-factor authentication (MFA).

TOTP authentication secures the seed storage of the authenticator at the instance level.
The seed is the secret key of the authenticator that is used to generate the TOTP.

Familiarize yourself with multi-factor authentication (MFA) concepts. For more information, see [Multi-factor authentication](https://www.servicenow.com/docs/access?context=mfa-landing&version=australia&pubname=australia-platform-security&ft:locale=en-US).

## TOTP authentication architecture {#totp-authentication-rpa__section_fvm_z3p_pvb}

The secret key (Seed) resides in the RPA Hub
server.

The decrypted TOTP is passed to the Unattended Robot and RPA Desktop Design Studio through a secure channel.

The following diagram shows the architecture of the TOTP authentication in RPA Hub.  
Figure 1. Architecture of the TOTP authentication in RPA Hub

## New fields and tables configuration {#totp-authentication-rpa__section_cwg_ygp_pvb}

To enable TOTP authentication in the RPA Hub, do the following actions:

* Create a multi-factor authentication (MFA) authenticator record in the classic environment. For more information, see [Create an MFA authenticator in RPA Hub](https://www.servicenow.com/docs/1Eo_Q3qMCMXI3M0vEL0KYA "Define the authenticator and token length that acts as an enabler for the Time-based One-time Password (TOTP) authentication in RPA Hub so that the unattended robots can seamlessly authenticate against multi-factor authentication (MFA)-enabled applications.").
* Associate a TOTP authenticator to a robot credential with the secret key (Seed). You can do this task in the workspace and classic environment. For more information, see [Create a TOTP authenticator in RPA Hub](https://www.servicenow.com/docs/FTfyLWmXY4aJ7jUYYKBt5g "Map a multi-factor authentication (MFA) authenticator record with a seed in a robot credential. This mapping results in creating a Time-based One-time Password (TOTP) authenticator record in RPA Hub.").
{#totp-authentication-rpa__ul_wqr_thp_pvb}

In the RPA Desktop Design Studio, as an RPA developer, you can define the GetTOTP component (previously known as the getOKTAtoken component) with AuthenticatorName as an input parameter. The authenticator name that you
provide from the component is compared against the unique authenticator name in the TOTP record. If the comparison is successful, the TOTP password is generated. For more information, see [Use the GetTOTP component](https://www.servicenow.com/docs/uOYhdn0U8XLniykxFHt~5A "Generate the Time-based One-time Password (TOTP) to access multi-factor authentication (MFA)-enabled applications in an automation by using the GetTOTP component in the RPA Desktop Design Studio application.").
**Related tasks**   

* [Delete a TOTP authenticator in RPA Hub](https://www.servicenow.com/docs/KzI~is72n1As9YEOvFSlew "Delete a Time-based One-time Password (TOTP) authenticator record in RPA Hub so that you can dissociate it from a bot process.")
* [Retire an MFA authenticator in RPA Hub](https://www.servicenow.com/docs/cghaX7DT5O8R_cBH7g8U1A "Retire a multi-factor authentication (MFA) authenticator in RPA Hub so that you can turn off the authentication. After you retire an MFA authenticator, it can’t be used again.")