Two-Factor Authentication (TOTP) in Crypto Mobile App
TOTP (Time-based One-Time Password, RFC 6238) — standard implemented by Google Authenticator, Authy, most corporate 2FA apps. For crypto app, mandatory minimum: SMS codes interceptable via SIM-swap, TOTP — no.
How TOTP Works
Algorithm: HMAC-SHA1 from current time (30-second window) and shared secret. Shared secret generated at 2FA setup and stored both server and user (in authenticator app). No network transmission per auth — just code verification.
On backend verification via: pyotp (Python), otplib (Node.js), google-authenticator (Java). On mobile client, code entered manually from authenticator — no additional TOTP logic needed.
Embedding 2FA in Login Flow
Classic flow: login/password → server check → if user has 2FA enabled, return temporary token → mobile shows TOTP entry screen → server verifies code and issues full JWT.
sealed class LoginState {
object Idle : LoginState()
object Loading : LoginState()
data class TwoFactorRequired(val tempToken: String) : LoginState()
data class Success(val authToken: String) : LoginState()
data class Error(val message: String) : LoginState()
}
class LoginViewModel(private val authRepository: AuthRepository) : ViewModel() {
val state = MutableStateFlow<LoginState>(LoginState.Idle)
fun submitTOTP(code: String, tempToken: String) {
viewModelScope.launch {
state.value = LoginState.Loading
authRepository.verifyTOTP(code, tempToken)
.onSuccess { token -> state.value = LoginState.Success(token) }
.onFailure { e ->
state.value = LoginState.Error(
if (e is InvalidCodeException) "Wrong code" else "Server error"
)
}
}
}
}
2FA Setup by User
Important step — onboarding. Show QR code for scanning in Google Authenticator / Authy, plus text secret for manual entry. QR contains otpauth:// URI:
otpauth://totp/CryptoApp:[email protected]?secret=BASE32SECRET&issuer=CryptoApp&algorithm=SHA1&digits=6&period=30
On Android generate QR via zxing-android-embedded or qrcode-kotlin. On iOS — CoreImage.CIFilter.qrCodeGenerator.
After scanning — mandatory verification: user enters first generated code, backend checks before saving 2FA. Prevents situation where QR poorly scanned and user locked immediately after setup.
Backup Codes
Without backup codes, 2FA in crypto app — risk of irreversible access loss. Generate 8–10 one-time codes on 2FA activation. Backend stores as bcrypt hashes. Mobile shows once with ability to copy or download as text file.
Backup code implementation requires separate login flow branch: TOTP input field — offer switch to "Use backup code". After use — code invalidated, user warned about remaining count.
2FA Screen Protection
Critical in crypto apps: 2FA input screen shouldn't allow screenshots. On Android:
window.addFlags(WindowManager.LayoutParams.FLAG_SECURE)
On iOS UIScreen doesn't prevent screenshots directly, but can hide content on applicationWillResignActive. For input field — isSecureTextEntry = true so text not visible in autofill.
TOTP 2FA integration (setup, login flow, backup codes, screen protection) — 1–2 weeks. Cost estimated individually.