Skip to content
  • There are no suggestions because the search field is empty.

How do I run authenticated web scans using TOTP authentication?

This article describes how to set up authenticated web application scans for accounts that use two-factor authentication with a time-based one-time password (TOTP) from an authenticator app.

The scanner generates a fresh one-time code during each scan, so you do not need to disable two-factor authentication for the scanning account.

Supported two-factor methods
This setup only works for time-based one-time codes from an authenticator app (TOTP). The following methods cannot be automated:

  • Codes sent by SMS or email
  • Push approvals, e.g., "Tap Approve in the app"
  • Hardware security keys (FIDO2/WebAuthn)

If the scanning account uses one of these methods, exempt the account from two-factor authentication or switch it to an authenticator app.

Prepare your TOTP secret

The TOTP secret is the text string shown when two-factor authentication is set up for an account. The scanner uses it to generate valid codes.

  1. Find the secret for the scanning account. It is usually shown behind a link such as Can't scan the QR code?, Enter this code manually, or Setup key.
  2. Copy the secret. It looks like this: "JBSWY3DPEHPK3PXP".
  3. Remove any spaces and keep all letters uppercase.

The secret is not the six-digit code
The secret is not the six-digit code shown in your authenticator app. The scanner generates those codes from the secret.

Lost secret
If the secret was not saved when two-factor authentication was set up, it usually cannot be retrieved afterwards. In that case, disable two-factor authentication for the scanning account and enroll it again. Copy the secret before you complete the setup.

Record the login sequence

Record the login sequence in the same way as for multistep authentication. Follow the instructions in How do I record the login sequence?

During the recording, enter the six-digit code from your authenticator app as usual.

Replace the recorded code with a TOTP step

The recording contains the six-digit code you entered by hand. That code is only valid for a short time, so you need to replace it with a TOTP step that generates a new code each time the scan runs.

  1. Open the downloaded JSON file in a text editor.
  2. Find the step that entered the code. It is the step that contains "type": "change" and a "value" with the six-digit code you entered, e.g., "123456". The step also contains a "selectors" section that points to the code field on the login page, e.g., "#totpPasscode".
  3. Change the step as follows:
    • Change "type": "change" to "type": "totp".
    • Delete the "value" line with the six-digit code.
    • Keep the "selectors" section exactly as it is.
    • Add a "secret" line with your TOTP secret, e.g., "secret": "JBSWY3DPEHPK3PXP".

Check the commas
Each line inside the step must be separated by a comma. If you add the "secret" line after the "selectors" section, add a comma after the closing bracket of "selectors".

         4. Leave the rest of the sequence unchanged, including any click on a Verify or Submit button that follows.

          5. Save the file.

           6.Done!

Upload the edited file 


You upload it in the web application's authentication settings, the same way as a normal multistep login recording.

  1. Log in to Security Center.
  2. Click Assets > Web applications & APIs.
  3. Find the web application and click the edit icon.
  4. Click Scan settings and check JavaScript scanning.
  5. Click Authentication and select Multi-step authentication.
  6. Enter the Authentication record name, Success validation URL and Success validation string.
  7. Click Select file..., select your edited JSON file and click OK.

Slow two-factor screens
If the two-factor authentication screen loads slowly, add a short wait before the TOTP step.