When you enable TOTP on a Secret, you enter the TOTP seed key provided by the target service (the same key you would scan as a QR code in Google Authenticator). Vault stores this seed encrypted alongside the Secret. At login time, the Vault browser extension can fill both the password and the current 6-digit TOTP code into the appropriate fields. The TOTP code regenerates every 30 seconds according to the RFC 6238 standard, same as any other authenticator app.
Add a TOTP seed to a Secret whenever the associated service requires two-factor authentication and the account is shared by more than one person. This avoids binding the second factor to a single team member’s phone. It is equally useful for individual accounts if you want both factors centralised in your vault rather than split across Vault and a mobile authenticator. Avoid storing TOTP in Vault for accounts where security policy explicitly requires the second factor to remain on a separate physical device.
Storing both factors in the same vault reduces the security separation that two-factor authentication is designed to provide. This is a deliberate usability tradeoff and is appropriate for shared team accounts where distributing a phone is impractical. For individual accounts with high security requirements, keep TOTP on a hardware token or separate authenticator app. Ensure your Vault account itself is protected with strong MFA, because it now holds both factors for every linked service. Back up TOTP seeds when initially setting them up, as the target service may not allow re-scanning the QR code later.
Yes. When you share a Secret that has a TOTP seed attached, the recipient can also view and auto-fill the TOTP code, subject to the permission level granted. If the recipient has view-only access, they can use the TOTP code to log in but cannot modify the seed. This makes TOTP sharing as simple as Secret sharing, with the same access controls applying to both factors.
The TOTP seed is stored as part of the Secret record and is deleted along with it. If the Secret is soft-deleted, an admin can restore it with the seed intact within the retention period. If permanently deleted, the seed is gone. Before deleting any Secret with a TOTP seed, disable or re-configure two-factor authentication on the target service first, otherwise you may lose access to that account permanently.
Aaxonix is a certified Zoho implementation partner based in Pune. Architecture-first, no surprises.