What Is an otpauth URI? TOTP QR Setup Explained
Learn otpauth URI, how TOTP authentication works, common configuration issues, privacy considerations, and when to use the ToolNivo 2FA Code Generator.
Core concept
An otpauth URI is a provisioning format widely used by authenticator software. For TOTP it can package a secret plus account and configuration information.
How it works
A QR image can encode provisioning data so an authenticator imports settings without manual typing.
Settings that must match
If an otpauth URI contains the shared secret, exposing the URI can expose the second-factor seed. Do not place it in public links, screenshots or logs.
Common mistakes to avoid
Issuer and account labels help identify entries but do not replace the cryptographic secret.
Security and recovery
Import only setup data supplied by the account provider and verify uncertain enrollment information in the provider's security settings.
Standards note: Technical explanations follow RFC 6238 and, where relevant, RFC 4226. Always follow your account provider's configuration and recovery instructions.
Frequently asked questions
Can a TOTP generator bypass 2FA?
No. It needs the correct shared secret and matching settings.
Does TOTP depend on the device clock?
Yes. TOTP uses time as part of its moving factor, so significant clock disagreement can cause rejection.
Should I share my TOTP secret?
No. Treat the shared secret as sensitive authentication material.