# OTP Screen

Displays the current TOTP (Time-based One-Time Password) code for each enrolled bank authenticator. Used when confirming transfers, QR payments, or other 2FA-protected operations.

---

## Fragment — `OtpFragment`

Hosts one card per enrolled bank authenticator. Banks with no stored TOTP seed are not shown.

---

## TOTP Display

Each card shows:
- Bank logo and name
- The current 6-digit TOTP code (large text)
- A circular countdown ring showing time remaining in the current 30-second window
- The code refreshes automatically when the window expires — no user interaction needed

### Algorithm

Standard RFC 6238 TOTP:
- Hash: SHA-1
- Window: 30 seconds
- Digits: 6
- Seed: stored per-bank in `CredentialStore` (encrypted)

---

## Supported Banks

One card is rendered for every MIB and every BML login that has a stored OTP seed (`OtpFragment.kt:93-98`). Seeds are per-`loginId` in `CredentialStore`.

| Bank | Seed source | Card label |
|---|---|---|
| MIB | `loadMibCredentials(loginId).otpSeed` (entered at login) | `"MIB · {fullName}"` |
| BML | `loadBmlCredentials(loginId).otpSeed` (entered at login) | `"BML · {fullName}"` |

If no full name has been cached the label falls back to plain `"MIB"` / `"BML"` and a background `MibProfileClient.fetchPersonalProfile()` / `BmlAccountClient.fetchUserInfo()` call refreshes it.

---

## Background Name Refresh

When the screen opens, the fragment may fire a background API call to refresh the account holder name associated with each seed. This is a best-effort call — failure does not affect OTP display.

---

## Usage

The OTP screen is informational — the user copies the displayed code manually and enters it wherever required (e.g., in `TransferFragment`'s OTP dialog, or in an external portal). The code is never submitted automatically from this screen.

---

## Security

The TOTP seeds are stored encrypted in `CredentialStore`. They are never logged or included in error reports.

---

 

---

[← Activities](09-activities.md)     **Next →** [PayMV QR Screen](11-paymv-qr-screen.md)