--- sourceDocument: Brazil Workflow Data Fabric sourceDocumentLink: https://www.servicenow.com/docs/r/integrate-applications Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Workflow Data Fabric ft:clusterId : - crint bundleId : - crint workflow : - Creator --- # Create a TOTP authenticator in RPA Hub # Create a TOTP authenticator in RPA Hub {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Map a multi-factor authentication (MFA) authenticator record with a seed in a robot credential. This mapping results in creating a Time-based One-time Password (TOTP) authenticator record in RPA Hub. ## Before you begin Familiarize yourself with multi-factor authentication (MFA) concepts. For more information, see [Multi-factor authentication](https://www.servicenow.com/docs/access?context=mfa-landing&version=brazil&pubname=brazil-platform-security&ft:locale=en-US). Familiarize yourself with the TOTP authentication in RPA Hub. For more information, see [TOTP authentication in RPA Hub](https://www.servicenow.com/docs/iZUqiMnKmA6FENEs9mDuIA "You can configure the Time-based One-time Password (TOTP) fields in RPA Hub that enable the unattended robots to seamlessly authenticate against multi-factor authentication (MFA)-enabled applications."). Create an MFA authenticator record. For more information, see [Create an MFA authenticator in RPA Hub](https://www.servicenow.com/docs/_y4~RFwFHTKO6QIo0uhqDw "Define the authenticator and token length that acts as an enabler for the Time-based One-time Password (TOTP) authentication in RPA Hub so that the unattended robots can seamlessly authenticate against multi-factor authentication (MFA)-enabled applications."). Create a robot credential. For more information, see [Create a robot credential in RPA Hub](https://www.servicenow.com/docs/oKeoN0Q11ge6srmW7n8aYQ "Create a robot credential so that the unattended robot can log in to a Windows machine and perform the automation."). Do this task only when you select the Process Type field as Unattended on the Bot process configuration form while you're creating a bot process. For more information, see [Configuring a bot process record in RPA Hub](https://www.servicenow.com/docs/Fh5n_jyVL~kis5vxVwxTSQ "In RPA Hub, you can create a bot process configuration record and assign assets to associate it with a bot process. Or you can just save the bot process configuration record, however it won't be associated to a bot process. It remains orphaned."), [Bot process configuration form in RPA Hub](https://www.servicenow.com/docs/DJh1I_B4PR0A~yi2jG5kFQ#bot-process-config-form "Use the Bot Process Configuration form to define the preliminary fields for a bot process record."), and [Bot Process form in RPA Hub](https://www.servicenow.com/docs/1SYpQgsolYA0s6xdTr1KNg#bot-process-form "Use the Bot Process form to associate it to the bot process configuration and populate the remaining fields required for a bot process."). Verify that the life-cycle stage status of the associated bot process is set to either Build or In Maintenance. Role required: sn_rpa_fdn.rpa_developer, sn_rpa_fdn.rpa_release_manager or sn_rpa_fdn.rpa_admin ## About this task A seed is a secret key of the authenticator that is used to generate the TOTP. An authenticator application is a third-party software that generates temporary passcodes. Users can use these passcodes with their password to log in to an instance that requires multi-factor authentication (MFA). With TOTP authentication, you can store the seed of the authenticator at the instance level so that your unattended robots can seamlessly authenticate against MFA-enabled applications. If a TOTP authenticator is using external credential vault, then ensure that the associated external credential vault is active. In RPA Hub, you can retrieve robot credentials, application credentials, or TOTP seed in two ways: * From ServiceNow credentials record (application credential, robot credential, or TOTP authenticator). * From an external credential vault. For more information, see [External credential vault in RPA Hub](https://www.servicenow.com/docs/Wk1sxxweAhhwYzQ2hhx6tA "With the external credential vault feature, you can retrieve robot credentials, application credentials, or Time-based One-time Password (TOTP) seed."). {#map-totp-credential-set-rpa__ul_xtr_r2l_zzb} ## Procedure 1. Navigate to AllRobotic Process AutomationRPA Hub Workspace. 2. Select the list icon (![List icon.]()). 3. On the Lists tab, under Credential Management, select Robot Credentials. 4. Select the robot credential record that you want to associate an MFA authenticator record to. 5. On the TOTP Authenticators tab, select New. 6. On the form, fill in the fields. {#map-totp-credential-set-rpa__table_lgf_nm1_sqb__entry__2} | Field | Description | |-|-| | Authenticator | MFA authenticator to be mapped to this robot credential. Alternatively, you can select the search icon and select the MFA authenticator. For example, Okta. | | Seed | Secret key of the authenticator that is used to generate the TOTP. This field does not appear if the External Credential check box is selected. | | External Credential | Select this check box to fetch the seed from external credential vaults. | | External Credential Vault | Select an external credential vault record that is used for fetching the seed from an external credential vault. Use the search icon to select an external credential vault record. For example, DemoCyberArk. Only active external credential vault records are listed here. This field appears only when the External Credential check box is selected. | | Subflow Input | Provide a JSON that acts as an input to the subflow mapped in the selected external credential record. This JSON is used by the Subflow REST Step and must contain the necessary information for retrieving seed from the external credential vault. The value must be in JSON format. You cannot enter an empty JSON value. For more information about the JSON, see [Steps to configure an external credential vault in RPA Hub](https://www.servicenow.com/docs/WWQERzZCCEm~Mm8ii7wIEw "Use this list of steps to guide you through all the tasks of configuring an external credential vault in RPA Hub."). This field appears only when the External Credential check box is selected. | [Table 1. TOTP Authenticator form] {#map-totp-credential-set-rpa__table_lgf_nm1_sqb} 7. Select Save. 8. **Optional:** In the Activity and Compose fields, view the activity of the form, work notes, and additional comments. {#map-totp-credential-set-rpa__steps_qq5_znp_pvb} ## What to do next [Use the GetTOTP component in the RPA Desktop Design Studio to generate TOTP](https://www.servicenow.com/docs/Rxyoyb2RNa5ecod9KrOe~w "Preview the data of a Data port in RPA Desktop Design Studio to view and verify if the result of a port is correct and is as expected."). **Related tasks** * [Delete a TOTP authenticator in RPA Hub](https://www.servicenow.com/docs/2PeMXlPg4LLCM6uRilMzWg "Delete a Time-based One-time Password (TOTP) authenticator record in RPA Hub so that you can dissociate it from a bot process.") * [Retire an MFA authenticator in RPA Hub](https://www.servicenow.com/docs/UMYwwBCgZKCy5HM91LPabA "Retire a multi-factor authentication (MFA) authenticator in RPA Hub so that you can turn off the authentication. After you retire an MFA authenticator, it can’t be used again.") *[\>]: and then