# OTP settings

## Definition

The OTP settings allow the administrator users to configure the available OPT options. Soffid provides four different OTP implementations.

`Main Menu > Administration > Configuration > Security settings > OTP settings`

## Screen overview

[![image-1698996143859.png](https://bookstack.soffid.com/uploads/images/gallery/2023-11/scaled-1680-/image-1698996143859.png)](https://bookstack.soffid.com/uploads/images/gallery/2023-11/image-1698996143859.png)

[![image-1698996183374.png](https://bookstack.soffid.com/uploads/images/gallery/2023-11/scaled-1680-/image-1698996183374.png)](https://bookstack.soffid.com/uploads/images/gallery/2023-11/image-1698996183374.png)

## Standard attributes

### Email

- **Enabled**: allows you to enable or disable the OTP implementation.
- **Number of digits**: number of digits of the PIN code that will be generated.
- **Subject**
- **Body**
- **Number of failures to lock the token**

<p class="callout warning">To send an email, will be mandatory to fill in the value of the **mail.from** parameter. You can visit the [mail server parameters](https://bookstack.soffid.com/link/86#bkmrk-mail-server).</p>

### SMS

- **Enabled**: allows you to enable or disable the OTP implementation.
- **Number of digits**: number of digits of the PIN code that will be generated.
- **URL to send the SMS**: enter the URL of your SMS provider rest service

```
https://www.xxxxxxx.com/cgi-bin/sms/http2sms.cgi?account=sms-bg490971-1&password=XXXXXXt&login=user&from=SOFFID&to=${PHONE}&message=This is your access PIN: ${PIN}&noStop&contentType=application/json&class=0
```

- **HTTP Method**: enter POST or GET depending on your provider documentation
- **HTTP Header**: optionally, you can add any HTTY header, including Basic or Bearer authentication tokens. The header must include the header name and header value. For instance:  
    `Authorization: Basic <span style="background-color: #f8f8f8; font-family: 'Lucida Console', 'DejaVu Sans Mono', 'Ubuntu Mono', Monaco, monospace; font-size: 0.84em; white-space: pre-wrap;">dXNlcjpwYXNzd29yZA==</span>`
- **POST data to send** Enter the body of the HTTP request
- **Text to be present in the HTTP response**: Soffid will check the response from your SMS Provider contains this text

```
"status":100
```

- **Number of failures to lock the token**

The URL and POST data to be sent, the administrator can use some tags that will be replaced by some target user attributes:

- ${PHONE}: The target phone number
- ${PIN}: The one-time password to be entered by the user
- ${userAttribute}: Any of the standard or custom user attributes, like ${fullName} or ${userName}

### Voice (alternative to SMS)

- **Enabled**: allows you to enable or disable the OTP implementation.
- **URL to send the SMS**: enter the URL of your voice call provider rest service
- **HTTP Method**: enter POST or GET depending on your provider's documentation
- **HTTP Header**: optionally, you can add any HTTY header, including Basic or Bearer authentication tokens. The header must include the header name and header value. For instance:  
    ```
    Authorization: Basic xxxxxxxxxxxxxxOUVCRS1DMzE0LTI3MzAtQkY0Qy05RDgwRTMyQUQ4OUY=
    Content-Type: application/json
    Accept: application/json
    ```
- **POST data to send** Enter the body of the HTTP request. ```
    Text to be present in the HTTP response: Soffid will check the response from your SMS Provider contains this text
    ```

The POST data to be sent, the administrator can use some tags that will be replaced by some target user attributes:

- - ${PHONE}: The target phone number
    - ${PIN}: The one-time password to be entered by the user
- **Number of failures to lock the token**

### Time based HMAC Token

- **Enabled**: allows you to enable or disable the OTP implementation.
- **Number of digits**: number of digits of the PIN code that will be generated.
- **Algorithm**: allows you to select an HMAC algorithm.
- **Issuer**
- **Number of failures to lock the token**

### Event based HMAC Token

- **Enabled**: allows you to enable or disable the OTP implementation.
- **Number of digits**: number of digits of the PIN code that will be generated.
- **Algorithm**: allows you to select an HMAC algorithm.
- **Issuer**
- **Number of failures to lock the token**

### Security PIN

- **Enabled**: allows you to enable or disable the Security PIN implementation.
- **Minimum PIN length**: minimum number of digits that the PIN has to have.
- **Number of digits from the PIN to ask**: number of digits that Soffil will ask to verify the identity.
- **Number of failures to lock the token**

## Actions

<table border="1" id="bkmrk-query-allows-to-sear-0"><tbody><tr><td style="width: 166px;">**Confirm changes**</td><td style="width: 643px;">Allows you to save the updates and quit the page.

</td></tr></tbody></table>