To program a TOTP hardware token, you start two-factor setup on the service as if you were adding an authenticator app, then write the QR code’s secret key into the token instead. With Protectimus Flex or Slim NFC, the Protectimus TOTP Burner app on an NFC-enabled Android phone transfers the key and sets the token’s clock.
What Is a Programmable TOTP Token?
Hardware TOTP tokens come in two kinds. A classic token has its secret key (seed) written at the factory, and the administrator imports that seed into the MFA system. A programmable token arrives empty, or with a key you can overwrite, and you write the key yourself, taken from the service you want to protect. For a broader look at the difference, see how hardware and software tokens compare.
That difference changes where the token can be used. A classic token only works with systems that let an administrator import seeds. A programmable token works with any service that offers “use an authenticator app” during two-factor setup, because the token simply takes the place of the app. No Protectimus account or platform is needed for this.
A programmable token holds one secret key at a time, so it protects one account. When the account is no longer needed, or the token moves to another employee, you write a new key over the old one. The Protectimus Flex programmable token can be reprogrammed an unlimited number of times.
Codes are generated on a device with no network connection and no other software, so there is nothing on it for malware to infect. And once a key is written, it cannot be read back from the token, not even by the app that wrote it.
Protectimus makes two programmable models that work the same way and differ only in shape. Protectimus Slim NFC is a card that fits in a wallet; Flex is a key fob that attaches to a key ring, which is harder to lose. The key fob version exists because customers asked for it: some were drilling holes in Slim NFC cards or making a custom case for them. Flex also has a battery indicator, so you know when to plan a replacement. For more on the card version, see this article.
Which Services Work with Programmable Tokens
The rule is simple: if a service supports two-factor authentication with an MFA app software token and shows a QR code or a secret key during setup, a programmable token can usually replace the app. There is one technical limit to check: the secret key must be no longer than 32 characters in Base32.
Services where Protectimus Flex and Slim NFC are already used include Office 365, Google, PayPal, X (Twitter), Facebook, Dropbox, GitHub, and Coinbase, along with many payment systems and cryptocurrency exchanges.
Microsoft Entra ID Without P1/P2
Microsoft Entra ID (Azure AD) deserves a separate mention. Classic OATH tokens are imported into Entra ID through a CSV file, and that requires an Entra ID P1 or P2 license. A programmable token skips that step: the user adds it in Security info as an authenticator app, which works without a premium license. The full scenario is described in the article on hardware tokens for Azure MFA. The step-by-step setup is in the guide on connecting hardware tokens to Microsoft Entra ID.
How to Program the Token: Step by Step
The steps are the same for Protectimus Flex and Slim NFC. You need the token and an Android smartphone with NFC; programming from an iPhone is not supported.
Step 1: Install Protectimus TOTP Burner
Install the free TOTP Burner application from Google Play on an NFC-enabled Android phone and make sure NFC is turned on in the phone settings.
Step 2: Start Two-Factor Setup on the Service
Sign in to the account you want to protect, open its security settings, and start enabling two-factor authentication. When the service asks how you want to receive codes, choose the authenticator app option. Keep the page with the QR code open.
Step 3: Write the Secret Key into the Token
- Open the TOTP Burner app.
- Tap “Burn the seed”.
- Tap “Scan the QR code” and scan the QR code shown by the service.
- Turn on the token and hold it against the phone’s NFC antenna.
- Tap “Continue”. When the app shows a confirmation message, the key is written.
During this step the app also sets the token’s clock from the phone, which is what keeps the codes in sync with the service.
Step 4: Confirm the Token on the Service
Go back to the service, press the button on the token, and enter the code it shows to complete setup. From now on, the token generates the codes for that account.
Common Issues
Most problems with programmable tokens come down to one of three things.
The Service Rejects the Codes
This is usually a time problem. The token takes its time from the phone during programming, so if the phone’s clock was wrong, the token will be off by the same amount. Check that the phone uses automatic date and time, then write the key again. For background on why tokens drift and how services handle it, see the article on the time drift problem; the TOTP algorithm article explains the time steps themselves.
The Secret Key Does Not Fit or the Codes Never Match
Check the key length first: it must be 32 Base32 characters or fewer. Then check what the service generates. Flex and Slim NFC produce 6-digit codes with SHA-1 and a 30- or 60-second step, which is the default for most services. A service that uses SHA-256 or 8-digit codes will not accept them. Scanning a QR code from an older, abandoned setup attempt also gives a key the service no longer expects, so restart setup and scan the current one.
The Phone Does Not Detect the Token
Make sure the token is turned on and NFC is enabled on the phone. The NFC antenna is usually in the upper part of the back of the phone, but its position varies by model, so move the token slowly across the back. A thick or metal phone case can block the signal; take it off for programming.
FAQ
Can I program the token from an iPhone?
No. The Protectimus TOTP Burner app is available only for Android, and the phone must have NFC. One Android phone can be used to program any number of tokens.
Can one programmable token protect several accounts?
No. It holds one secret key at a time. To move it to another account, write a new key over the old one; the previous account then needs a new second factor.
Is it safe to program a token through a smartphone app?
The app only transfers the key to the token and does not store it. After programming, the key cannot be read back from the token. The token itself has no network connection, so it can’t be reached remotely.
Does the token need to be connected to anything after programming?
No. It works fully offline, generating codes from the stored key and its internal clock. Only the service you sign in to needs to be online.
How long does the battery last?
Protectimus Flex and Slim NFC are rated for 3 to 5 years of battery life. Flex also has a battery indicator, so you can see in advance when it is time to plan a replacement.
The same steps work for any programmable model in the range of Protectimus OATH hardware tokens. Technical specifications and ordering details for the key fob version are on the Protectimus Flex page.
Read more
- TOTP Algorithm Explained
- The Pros and Cons of Different Two-Factor Authentication Types and Methods
- 2FA Security Flaws You Should Know About
- What Is a Hardware Token and How Does It Compare to Software Tokens?
- How Two-Factor Authentication for Windows Works
- Two-Factor Authentication Solutions Comparison: Google Authenticator vs. Protectimus
- On-Premise 2FA vs Cloud-Based Authentication
- Remote Work: How to Transition Team to Working From Home During the COVID-19 Pandemic
- Securing VPN with Two-Factor Authentication
Subscribe To Our Newsletter
Join our mailing list to receive the latest news and updates from our team.
2021-01-17
How is it protected from unauthorized access? If it is stolen, for example.
2021-01-20
Valery, if you use this or any other OTP token with Protectimus two-factor authentication system, the Protectimus administrator can set up additional PIN protection. In this case, the user will have to enter a PIN code every time they enter a one-time password from the token before or after the OTP. This approach makes a token useless for the fraudster as a one-time password won’t work without a PIN. But if you use the programmable hardware OTP token with any other service, then when it’s stolen, it’s stolen, and the person who has stolen the token knows your one-time passwords. Though they still need to know your static password to get access to your account, so you’ll have time to notice the token’s missing and take action.