01Seed enroll
Code check
Recovery
Why TOTP?
SMS OTP is billed per message and affected by delay and number portability. TOTP generates a 6-digit code offline with no per-use telecom fee.
- Lower OTP SMS spend
- Lower SIM-swap / intercept risk
- Familiar Authenticator UX
- SMS fallback still available
How it works
Encrypted secrets, challenges, verify, lockouts and audit on the platform; you call /v1/totp. Optional QR enrol in Contacts; admins set fallback paths.
- Enroll → Confirm → Challenge → Verify
- Public API
- Contacts QR
- e.g. customer_totp → sms
Hybrid fallback
Prefer registered device / TOTP, then Email OTP if needed, SMS recovery last. Record reason and outcome on every switch.
- Governable priority
- Timeouts and retries
- Risk and daily caps
Go live in four steps
Consult or register → enable channels and fallback → API key / Contacts enrol → validate on a small cohort, then expand.
Security
No plaintext secret after first confirm; rate limits, replay protection, clock skew; recovery under admin control.