2.5 KiB
OTP Screen
Displays the current TOTP (Time-based One-Time Password) code for each enrolled bank authenticator. Used when confirming transfers, QR payments, or other 2FA-protected operations.
Fragment — OtpFragment
Hosts one card per enrolled bank authenticator. Banks with no stored TOTP seed are not shown.
TOTP Display
Each card shows:
- Bank logo, bank name and account holder name
- A circular countdown ring with the seconds left in the current 30-second window; the ring and code turn red in the last 5 seconds
- The current 6-digit TOTP code (large text) with a copy button
- The next window's code (smaller, below a divider) with its own copy button — handy when the current code is about to expire
- The codes refresh automatically when the window expires — no user interaction needed
Tapping anywhere on the card also copies the current code. If no logins have a seed, an empty-state message is shown instead.
Algorithm
Standard RFC 6238 TOTP:
- Hash: SHA-1
- Window: 30 seconds
- Digits: 6
- Seed: stored per-bank in
CredentialStore(encrypted)
Supported Banks
One card is rendered for every MIB and every BML login that has a stored OTP seed (OtpFragment.kt), sorted by the user's login order. Seeds are per-loginId in CredentialStore.
| Bank | Seed source | Card title / subtitle |
|---|---|---|
| MIB | loadMibCredentials(loginId).otpSeed (entered at login) |
MIB / {fullName} |
| BML | loadBmlCredentials(loginId).otpSeed (entered at login) |
BML / {fullName} |
If no full name has been cached the subtitle falls back to "Authenticator" and a background MibProfileClient.fetchPersonalProfile() / BmlAccountClient.fetchUserInfo() call refreshes it.
Background Name Refresh
When the screen opens, the fragment may fire a background API call to refresh the account holder name associated with each seed. This is a best-effort call — failure does not affect OTP display.
Usage
The OTP screen is informational — the user copies the displayed code manually and enters it wherever required (e.g., in TransferFragment's OTP dialog, or in an external portal). The code is never submitted automatically from this screen.
Security
The TOTP seeds are stored encrypted in CredentialStore. They are never logged or included in error reports.
← Activities Next → PayMV QR Screen