Step 1 — Add the secret

• Tap Scan QR code and point the camera at the TOTP QR code shown by the service you are securing.
• If you need to enter the secret by hand instead, type or paste it into the secret field. The app automatically recognizes both Base32 and hexadecimal secrets, as well as full otpauth:// links — there is no longer a separate mode to choose.
• If you accidentally scan the wrong code (such as the barcode printed on the token, which is only its serial number), the app explains the problem and points you to the correct QR code.

Step 2 — Confirm the details

• Review what was captured: the service and account (when available), the secret length, and the TOTP parameters.
• To adjust parameters, tap Change. Here you can set the time step (30 or 60 seconds), the hashing algorithm (SHA-1 or SHA-256), and the display power-off timeout (15 to 120 seconds). These should match the settings defined by your authentication service. If you are unsure, leave the defaults of 30 seconds and SHA-1, as most TOTP authentication is hardcoded to these values. The display power-off timeout does not affect OTP calculation, so you can choose any value you prefer.
• The secret is written directly to the token over NFC and never leaves your device.

Step 3 — Power on the token

Press and hold the token's button until its screen lights up, then continue.

Step 4 — Hold the token to the phone

Rest the powered-on token flat against the NFC area of your phone. When the write completes, a confirmation is shown along with a live verification code you can compare against the token's own screen.

From the welcome screen you can open Time sync to correct a token whose codes have drifted out of step. The app sets the token's clock to the time you choose. Note that it is not possible to read the configuration or seed back from a token — the app can only write to it.

Exercise caution when changing a token's time. On most models, time synchronization deliberately clears the stored seed for security reasons, and you will need to re-program the token afterwards. Only three models keep their seed through a time sync: miniOTP-2, OTPC-P1, and C302. The app detects your model and warns you before making a change that would erase the seed.

Identify reads a token or other NFC device without writing anything, reporting its model, serial number, on-device time, and whether it has restricted or unrestricted time sync. It also recognizes when you have tapped a FIDO security key rather than a programmable token.

Expert mode gives manual control for advanced users: load a secret, set parameters, and choose exactly which operation to perform on the next tap (write seed and config, seed only, config only, or identify).