> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/access/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/access/key-components/authenticators/credential-validators/otp-validator.md).

# OTP validator

Used to validate a OTP either generated by an mobile app, token device or sent to the user via SMS/e-mail. Often used in conjunction with other authenticators. Requires modules AuthN & Pipes.

{% hint style="info" %}
**Note:** If validating an OATH token OTP click here: <https://docs.fortifiedid.se/tokens/oath>
{% endhint %}

*Using tokens when authenticating assumes that the user has a token.*\
*Fortified ID have a product called **Fortified ID Enrollment** to help user to easily enroll for tokens.*

## Configuration

{% hint style="info" %}
**Authenticator type:** `OTP | OTPAuthenticator | OTPValidator`
{% endhint %}

Common Authenticator configuration can be found [here](/access/key-components/authenticators/common-configuration.md).

{% tabs %}
{% tab title="Properties" %}

<table data-full-width="true"><thead><tr><th>Name</th><th>Description</th><th>Default value</th><th data-type="checkbox">Mandatory</th></tr></thead><tbody><tr><td><code>pipe_id</code></td><td>Pipe to use for validation.</td><td>N/A</td><td>true</td></tr><tr><td><code>pre_pipe_id</code></td><td>Pipe commonly used for sending OTPs.</td><td>N/A</td><td>false</td></tr><tr><td><code>allowed_otp_retry</code></td><td>Allowed number of times a user is allowed to enter OTP before process is aborted.</td><td><code>2</code></td><td>false</td></tr><tr><td><code>webroot_dir</code></td><td>See common authenticator configuration</td><td>web/authenticator/otp_validation</td><td>false</td></tr><tr><td><code>custom_identifier</code></td><td>Tag used for event separation</td><td>N/A</td><td>false</td></tr></tbody></table>
{% endtab %}

{% tab title="Example" %}

```json
{
  "id": "iodpwd",
  "type": "OTPValidator",
  "config": {
    "base_path": "/saml/authn",
    "context_path": "/saml/authn/otp",
    "pipe_id": "otp_validation_pipe"
  }
}
```

{% endtab %}
{% endtabs %}

{% hint style="warning" %}
Property *base\_path* should not contain the full path when used in conjunction with the [Selector](/access/key-components/authenticators/flow-control/selector.md), instead, the full URI will be handled by the selector. The full path will be *base\_path + / + id*.
{% endhint %}

## Logging

Apart from system logging, event logging is done when completing and failing a transaction.

Event ids are:

* WEB\_100019("OTP validated")
  * IDENTIFIER (user trace id)
  * CUSTOMER\_IDENTIFIER (if configured)
  * SOURCE\_ADDRESS (ip of the remote session)
* WEB\_100020("OTP validation failed")
  * IDENTIFIER (user trace id)
  * CUSTOMER\_IDENTIFIER (if configured)
  * SOURCE\_ADDRESS (ip of the remote session)

### Data sent to validation pipe

On otp-validation, data sent to pipe is:

* otp - entered by user

## Data exposed to global state

None

## API

### Starting an authentication

Start by sending in a Ajax request containing identifier & password:

```json
{
    "type": "start",
    "data": {
        "otp": "<otp>"
    }
}
```

The response back will contain either a COMPLETED or ERROR:

```json
{
    "status": "COMPLETED"
}
```

## Translation keys

```json
{
  "otp_validation.otp": "One-time password",
  "otp_validation.start_validate": "Verify one-time password",
  "otp_validation.verified": "One-time password verified",
  "otp_validation.redirecting": "Redirecting...",
  "otp_validation.cancel": "Cancel",
  "otp_validation.ERROR": "Wrong one-time password",
  "allow-cookies-body": "To save your language settings on this device you need to approve a language cookie.",
  "allow-cookies-button": "Approve language cookie",
  "authentication.help_text": "",
  "change_language": ""
}
```

```json
{
  "otp_validation.otp": "Engångslösenord",
  "otp_validation.start_validate": "Verifiera engångslösenord",
  "otp_validation.verified": "Engångslösenord verifierat",
  "otp_validation.redirecting": "Omdirigerar...",
  "otp_validation.cancel": "Avbryt",
  "otp_validation.ERROR": "Felaktigt engångslösenord",
  "allow-cookies-body": "Vill du spara dina språkinställningar på denna enhet behövs ett godkännande av  språk-cookie.",
  "allow-cookies-button": "Godkänn språk-cookie",
  "authentication.help_text": "",
  "change_language": ""
}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.fortifiedid.se/access/key-components/authenticators/credential-validators/otp-validator.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.