---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# TOTP authentication

# Time-based one-time password (TOTP) authentication {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
A time-based one-time password (TOTP) is a secure authentication factor that verifies user identity by generating a unique, time-sensitive code.{#totp-authenticator-apps__patch-rn-zp4-1}

TOTP authenticator apps like Okta Verify generate temporary numeric codes on a registered device, usually a mobile phone. These codes are only valid for a short time and can't be used more than once. This
approach offers enhanced security compared to static passwords.

## Use case {#totp-authenticator-apps__section_oww_51k_hhc}

TOTP authenticator apps are suitable for users who require stronger protection than standard multi-factor authentication (MFA) methods. TOTP factor can also be used for step-up authentication. For more information, see [Step-up authentication](https://www.servicenow.com/docs/nSRv0LPnB8I2AY6toKBwMg "Step-up authentication requires a caller who is already authenticated to complete an additional challenge before reaching an AI voice agent that handles a sensitive request.").

## Key strengths {#totp-authenticator-apps__section_qs5_v1k_hhc}

The TOTP authenticator apps method offers the following advantages:

* Local generation: One-time passwords are generated directly on the user's device and don't require an internet or mobile network connection.
* Security: TOTP is resistant to interception and SIM-swapping attacks, providing robust protection for the authentication process.
{#totp-authenticator-apps__ul_yrt_w1k_hhc}

## Important considerations {#totp-authenticator-apps__section_s3r_y1k_hhc}

The following considerations apply to TOTP authenticator apps:

* Initial setup: Users must set up the authenticator app on a registered device.
* Device management: Users must re-enroll when devices are replaced or reset.
* Phishing risk: One-time codes can be compromised if entered on untrusted or malicious sites.

{#totp-authenticator-apps__ul_hdh_z1k_hhc}

TOTP authenticator apps can help strengthen your organization's security posture. For detailed configuration instructions, see [Authenticator applications](https://www.servicenow.com/docs/f1ZUBXo9jsVU9aqhYunT1w "Use third party authenticator applications to generate temporary MFA pass codes.").