# OTP Screen

Displays the current TOTP (Time-based One-Time Password) code for each enrolled bank authenticator. Used when confirming transfers, QR payments, or other 2FA-protected operations.

---

## Fragment — `OtpFragment`

Hosts one card per enrolled bank authenticator. Banks with no stored TOTP seed are not shown.

---

## TOTP Display

Each card shows:
- Bank logo, bank name and account holder name
- A circular countdown ring with the seconds left in the current 30-second window; the ring and code turn red in the last 5 seconds
- The current 6-digit TOTP code (large text) with a copy button
- The next window's code (smaller, below a divider) with its own copy button — handy when the current code is about to expire
- The codes refresh automatically when the window expires — no user interaction needed

Tapping anywhere on the card also copies the current code. If no logins have a seed, an empty-state message is shown instead.

### Algorithm

Standard RFC 6238 TOTP:
- Hash: SHA-1
- Window: 30 seconds
- Digits: 6
- Seed: stored per-bank in `CredentialStore` (encrypted)

---

## Supported Banks

One card is rendered for every MIB and every BML login that has a stored OTP seed (`OtpFragment.kt`), sorted by the user's [login order](00-app-overview.md#login-order). Seeds are per-`loginId` in `CredentialStore`.

| Bank | Seed source | Card title / subtitle |
|---|---|---|
| MIB | `loadMibCredentials(loginId).otpSeed` (entered at login) | `MIB` / `{fullName}` |
| BML | `loadBmlCredentials(loginId).otpSeed` (entered at login) | `BML` / `{fullName}` |

If no full name has been cached the subtitle falls back to `"Authenticator"` and a background `MibProfileClient.fetchPersonalProfile()` / `BmlAccountClient.fetchUserInfo()` call refreshes it.

---

## Background Name Refresh

When the screen opens, the fragment may fire a background API call to refresh the account holder name associated with each seed. This is a best-effort call — failure does not affect OTP display.

---

## Usage

The OTP screen is informational — the user copies the displayed code manually and enters it wherever required (e.g., in `TransferFragment`'s OTP dialog, or in an external portal). The code is never submitted automatically from this screen.

---

## Security

The TOTP seeds are stored encrypted in `CredentialStore`. They are never logged or included in error reports.

---

 

---

[← Activities](09-activities.md)     **Next →** [PayMV QR Screen](11-paymv-qr-screen.md)