TOTP Two-Factor Authentication

Key points

• • 30-second TOTP codes - Constantly changing codes, cannot be reused

• • Authenticator apps - Google Authenticator, Authy, Microsoft Authenticator

• • Backup codes - Emergency codes when device is lost

• • Trusted devices - Mark trusted devices to skip 2FA for 90 days

• • Enforce 2FA - Admins can require 2FA system-wide

• • API Keys - Create API keys for scripts/integrations when 2FA enabled

Steps

• 1. Login to Odoo, go to My Profile → Account Security

• 2. Two-Factor Authentication tab, click "Enable Two-Factor Authentication"

• 3. Download authenticator app: Google Authenticator (iOS/Android), Authy, Microsoft Authenticator

• 4. Scan QR code displayed on screen with authenticator app

• 5. Enter 6-digit code from app to confirm

• 6. Save backup codes displayed (print or save to secure file)

• 7. 2FA activated, next login will require TOTP code

Steps

• 1. Enter username and password as usual

• 2. Screen requests verification code

• 3. Open authenticator app, view 6-digit code for Odoo

• 4. Enter code in form (code valid for 30 seconds)

• 5. Optional: Check "Remember this device" to skip 2FA for 90 days

• 6. Login successful

Key points

• • Each account has 10 backup codes

• • Use when device is lost or authenticator app not working

• • Each code can only be used once

• • Generate new backup codes: My Profile → Account Security → Generate New Codes

• • Store backup codes securely: print, save in password manager

Key points

• • Mark trusted device when logging in: Check "Remember this device"

• • Trusted device skips 2FA for 90 days

• • Only mark personal devices, not public computers

• • View list: My Profile → Account Security → Trusted Devices

• • Remove device: Click delete button next to unused device

Common Errors