For the complete documentation index, see llms.txt

Authenticator app code (TOTP)

A time-based one-time password (TOTP) is a temporary code generated by an authenticator app. SIAM uses TOTP—not other types of one-time password—as the code-based second factor for login.

What is TOTP authentication?

When a user sets up TOTP, SIAM and the user's authenticator app establish a shared secret. The app combines that secret with the current time to generate a new 6-digit code at regular intervals. The authenticator app can generate codes without a mobile network or internet connection.

During login, the user first enters their username or email address and password. SIAM then asks for the current code from the authenticator app. The password is the first factor—something the user knows—and the device containing the authenticator is the second factor—something the user has. Together, they provide multi-factor authentication (MFA).

Why use TOTP?

TOTP adds protection when a password is guessed, reused or exposed. Knowing the password alone is not enough to log in because the attacker also needs the current code from the user's authenticator.

TOTP is useful when you want to:

• Add a second factor without requiring specialist hardware.
• Support common authenticator apps across mobile platforms.
• Generate verification codes when the user's device is offline.
• Allow users to recover access with single-use recovery codes if their authenticator is unavailable.

Security consideration

Manually entered OTPs are not phishing-resistant because a user can be tricked into entering a valid code on a fraudulent website. For higher-risk services, consider offering passkeys, which use WebAuthn to bind authentication to the legitimate website. For more information, see the NIST guidance on phishing resistance.

Configure TOTP

Your SIAM administrator can require TOTP for all regular users, all administrators or an individual user. The administrator can also configure how long SIAM remembers a verified device. See Time-based one-time password settings.

End-user journeys

This section describes how your users can:

• Set up TOTP for their SIAM user profiles.
• Log in using an authenticator app code.
• Use a recovery code.
• Remove TOTP from their profiles.

How to set it up

Before setting up TOTP, your users must install an authenticator app, such as Google Authenticator, Microsoft Authenticator or Authy.

To set up TOTP from their profile, a user:

1. Logs in to your SIAM platform, then clicks their user icon in the top navigation bar.
2. From the dropdown menu, selects Manage profile. They are now on the Personal info page.
3. In the Multi-factor Authentication section, clicks Set up.
4. Enters their current password, then clicks Verify.
5. In their authenticator app, scans the QR code displayed by SIAM. If they cannot scan the QR code, they enter the displayed secret key manually.
6. Enters the 6-digit code from their authenticator app.
7. Continues to the Save recovery codes dialog, then downloads or copies the recovery codes and stores them securely.
8. Selects I have saved my recovery codes, then clicks Confirm.

Keep recovery codes safe

Each recovery code can only be used once. A user can use one if they lose access to their authenticator app.

How to log in using an authenticator app code

To log in using an authenticator app code, a user:

1. Goes to your SIAM platform URL.
2. Enters their username or email address and password, then clicks Log in.
3. On the Verify your identity page, opens their authenticator app and enters the current 6-digit authentication code.
4. Optionally, selects Remember this device. The length of time SIAM remembers the device is defined in SIAM settings.
5. Clicks Next.

The code expires after a short period. If SIAM does not accept it, the user should wait for the authenticator app to generate a new code and try again. They should also check that the time on their device is set automatically and is correct.

How to use a recovery code

If a user cannot access their authenticator app, they can:

1. Click Use backup code instead on the Verify your identity page.
2. Enter one of the recovery codes that they saved when they set up TOTP.
3. Continue the login flow.

The recovery code cannot be used again after a successful login.

How to remove TOTP

To remove TOTP from their profile, a user:

1. Logs in to your SIAM platform, then clicks their user icon in the top navigation bar.
2. From the dropdown menu, selects Manage profile. They are now on the Personal info page.
3. In the Multi-factor Authentication section, clicks Remove.
4. Enters their current password, then clicks Confirm.

If you require TOTP for the user's type, SIAM can ask them to configure it again the next time they log in.