> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ulm.m1amdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# One-Time Password Supports (OTP)

One-time password (OTP) is random-generated character string that's used to authenticate or verify a user. Digital Identity Management sends the OTP code to the user specified contact channel or preferred notification channel (PNC) by either SMS or email. The OTP is valid for the current session and can only be redeemed once to help prevent identity theft. Digital Identity Management supports OTP login with email, mobile, and with or without password.

OTPs provide an extra layer of security and implements a robust authentication scheme by:

* Augmenting or even replacing the user’s password with an OTP to prevent users from submitting a weak password or reusing an old password. See [Admin Console OTP Configuration](#section_f23_svl_xvb) for more details
* Digital Identity Management performs a check of the OTP's pkat and the current session to ensure a valid user submitted the value to minimize replay attacks. See [OTP Security](#section_tsy_41f_gxb) feature and the [Identity App error reporting](otpIdentityAppErrorReporting_r) for more details.
* Reduces administration and management of user passwords since OTPs are generated by the Digital Identity Management system.

## Identity App OTP Support

The Identity app supports the following onboarding and authentication implementations using an One-Time Password:

* User onboards with an email/mobile number and password. The user receives an OTP on their preferred notification channel (PNC) and needs to enter the OTP on their UI. This method is often used to fulfill two factor authentication (2FA) requirements.
* User onboards with an email/mobile number and is sent an OTP to their preferred notification channel (PNC). The user needs to enter the OTP on their UI to complete their login process.

## Admin Console OTP Configuration

Digital Identity Management provides configurable OTP settings in the [**Admin console**](https://docs.vindicia.com/bundle/b_connectAdminGuide/page/topics/adminIntroduction_c.html). The related app settings that can be implemented are:

* Short token case - OTP character casing used for the non-numeric digits
* Short token format - OTP token format that is sent to users for verification
* Short token length - OTP token length that is sent to users for verification
* Short token expiration - The OTP expiration period in minutes

  **Note:** The maximum expiration period is 5 minutes.

The OTP token settings determine the length and complexity of the One-Time Password (OTP) that the Digital Identity Management system generates and sends to a user in a notification message.

## OTP Security

**One-Time Password (OTP) Rotation And Invalidation**

When a One-Time Password (OTP) is reissued to a user, the OTP value is rotated and the previous OTP is no longer valid. For example, a user initially receives an OTP with the value `4452`, and then requests another OTP by SMS. The end user receives another OTP with an updated value of `5793`, and the previous OTP with the value `4452` is invalidated.

**Proof of Key Action Token (PKAT)**

A PKAT can expire or become mismatched from the access token required for the current session. To mitigate any issues, the PKAT value is updated when a new OTP is requested. The Digital Identity Management system issues a new corresponding value that is applicable for the current session and relevant token.

**Parent topic:**[Digital Identity Management Features](../topics/connectFeatures_tp)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.