How do I let the scanner get past a TOTP two-factor prompt on my app?

Steps

1. Go to the role in Authentication and scroll to the form login block.
2. Locate the TOTP secret field. Its placeholder reads optional.
3. Enter the TOTP secret for the scanning account. That is the secret key behind the account's authenticator-app code.
4. Complete the rest of the form login: login URL, username, password, success condition and login flow.
5. Press Save.

Good to know

• Create a dedicated test account for scanning and turn on two-factor sign-in for it on your app. Use the secret key your app shows at that moment.
• The field is optional. Leave it empty for accounts with no second step.
• Saved secrets stay hidden when you edit the role. Leave a field blank and the saved value stays.

This page covers the app you scan. Two-factor sign-in for your own Cyberlop users is separate and sits under Settings → Two-factor auth.

The capture does not say how the code reaches your page. Add the usual steps to the login flow and test the result. Need a hand? Use /contact. Scan only what you have permission to test.

Treat the secret like a password. Share it only with people who already manage the test account, and rotate it if you think it has leaked. When you change it on your app, come back here and paste the new value, otherwise the scanner keeps using the old one and the second step fails. This is a quick fix, but easy to forget.

Related questions

• How do I set up form login for the scanner?
• How do I write the login flow steps?
• How do I handle a login that asks for email and password on separate screens?
• The scanner isn't getting past my login page. What should I check?
• How do I set up two user roles so the scanner can test access between accounts?

Full tutorial

How to set up form login authentication in Cyberlop

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre