1.6 KiB
OTP Screen
Displays the current TOTP (Time-based One-Time Password) code for each enrolled bank authenticator. Used when confirming transfers, QR payments, or other 2FA-protected operations.
Fragment — OtpFragment
Hosts one card per enrolled bank authenticator. Banks with no stored TOTP seed are not shown.
TOTP Display
Each card shows:
- Bank logo and name
- The current 6-digit TOTP code (large text)
- A circular countdown ring showing time remaining in the current 30-second window
- The code refreshes automatically when the window expires — no user interaction needed
Algorithm
Standard RFC 6238 TOTP:
- Hash: SHA-1
- Window: 30 seconds
- Digits: 6
- Seed: stored per-bank in
CredentialStore(encrypted)
Supported Banks
| Bank | Seed source |
|---|---|
| BML | Enrolled via BML app setup; seed stored in CredentialStore |
| MIB | MIB business/corporate OTP seed (if applicable) |
Background Name Refresh
When the screen opens, the fragment may fire a background API call to refresh the account holder name associated with each seed. This is a best-effort call — failure does not affect OTP display.
Usage
The OTP screen is informational — the user copies the displayed code manually and enters it wherever required (e.g., in TransferFragment's OTP dialog, or in an external portal). The code is never submitted automatically from this screen.
Security
The TOTP seeds are stored encrypted in CredentialStore. They are never logged or included in error reports.
← Activities Next → PayMV QR Screen