Testing two-factor authentication with an authenticator app

This page explains how to test Time-Based One-Time Passwords (TOTP) for two-factor authentication (2FA).

In Autify Nexus, you can generate a TOTP using the Dynamic Value Step. Let's look at the steps for setting up 2FA and creating a Scenario, using GitHub as an example.

Preparation before creating a Scenario

1. Obtain the secret key

Obtain the secret key for generating TOTPs from your application under test. The secret key is often displayed as a QR code on the 2FA setup screen, but you must retrieve the text string. For example, on GitHub, the "setup key" text shown below links to the secret key.

2. Set up 2FA with an authenticator app in the target application

If you are setting up 2FA in the target application with an authenticator app for the first time, you must complete the setup process first. You can use any authenticator app, or follow the setup steps below using an Autify Nexus Scenario.

1. In any Scenario, add a Dynamic Value Step by navigating to Insert step > Dynamic Value Step.

   

2. Edit the added Dynamic Value Step with the following details:

   • Select Two-Factor Authentication Code (TOTP) for the Dynamic Value Type field.

   • Enter the secret key you obtained in the Secret field.

     

3. After that step, add a JavaScript Step (Insert step > JavaScript Step) and create a step that outputs the TOTP generated in step 2 to the console.

   

4. Save and run the Scenario. From the test result screen, copy the authentication code output to the console.

   

5. Enter the copied code into your target application to complete the setup.

   

Creating the Scenario

Once you have completed the 2FA setup with an authenticator app, you can create the actual test Scenario.

1. Record the steps in your target application as usual, up to the point just before authentication. Enter any temporary authentication code into the TOTP input field and save the Scenario.

   

2. Before the step where you entered the authentication code, add a Dynamic Value Step and edit it as follows:

   • Select Two-Factor Authentication Code (TOTP) for the Dynamic Value Type field.

   • Enter the secret key that you previously obtained in the Secret field.

     

3. In the step where you enter the authentication code, select Other step's output for the Text field. For the value, select the Dynamic Value Step you just added, and then save the Scenario.

   

Following these steps, you have successfully created a scenario that obtains and inputs a dynamically generated TOTP each time the test is run. To confirm that 2FA works as expected, you should run the created scenario.