# Bug OP-11744 - When TOTP fails due to clock skew, error is not easily discoverable

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-11744

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Module |  |
| Target versions | 12.5.0 |
| Observed in versions | 12.4.0 |
| Sprint | 12.5.0 |
| Backlog bucket |  |
| Bug found in version (deprecated) | 12.4.x |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | No |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

### Steps to reproduce

1.  Login as a user
2.  Go to My Account -> Two-factor authentication
3.  Click on "+", "Register device"
4.  Scan the qr code with a mobile device (using bitwarden as password application)
5.  enter the generated TOTP Code

### What is the buggy behavior?

Token is not accepted

_<img class="op-uc-image op-uc-image_inline" src="/api/v3/attachments/46598/content">_

### What is the expected behavior?

The token should be accepted.

Clock skew is causing the drift to not be acceptable.

## Additional Information

otpauth path looks like this (removed sensitve information):

`otpauth://totp/MYCOMPANYNAME%20OpenProject:mburk?secret=1234&issuer=MYCOMPANYNAME%20OpenProject`

### Environment information

_Please check and fill out the following details to help us identify in what versions and distributions of OpenProject the error occurs_

**OpenProject installation type**

*   [x] Packaged installation
    *   centOS

**OpenProject version**

v12.4.0 (Community Version)

**Browser**

*   [x] Chrome

**Language**

German