By: Lars Van Casteren user 05 Apr 2019 at 4:12 p.m. CDT

6 Responses
Lars Van Casteren gravatar
Hi, is it possible to display the OTP secret used to generate the QR code? Thanks! L

By Mohib Zico staff 15 Apr 2019 at 4:21 a.m. CDT

Mohib Zico gravatar
Hello Lars, Sorry, question not clear. Can you please explain a bit?

By Lars Van Casteren user 15 Apr 2019 at 4:41 a.m. CDT

Lars Van Casteren gravatar
The QR code contents is: ``` otpauth://totp/CompanyName%20Name2%20%20None?secret=UYCQ6CQFWEMWZRRV7JT4UCCRIGW46HQ57QEHHJY7WNMIGIVHBS6BY4MLNOVEMULTMHVYPJF6LQ44CMM54N7IB35UXICEYFEJ6WMRYPI&issuer=CompanyName%20Name2%20&digits=6&period=30 ``` Is there a way to also print the secret=<secret> as text next to the QR? On a side node, I noticed ``` "otpauth://totp/CompanyName%20Name2%20%20None?" ```, is there a way to change the "None" 's to something else in the generated QR? The OTP script configuration page does not seem to have values to substitute those? Thanks!

By Ray J. user 24 Apr 2019 at 9:47 a.m. CDT

Ray J. gravatar
I second this, especially since the data is there already, you just can't easily see it. This would be highly beneficial and Keycloak already allows you to click "Unable to scan?" and then shows you the secret which you can copy. It's not an image where you have to type it in. This is needed, especially in environments where the user doesn't have access to a phone or the ability to use a QR reader. Also using apps like Authy, at least the plug-in for a browser doesn't have a QR reader built-in. ![](https://i.ibb.co/FVvyVzs/gluu-no-option-to-display-secret.png) ![](https://i.ibb.co/kmd38tw/keycloak-unable-to-scan.png) ![](https://i.ibb.co/Ryr3ddm/keycloak-unable-to-scan-show-secret.png)

By Mohib Zico staff 26 Apr 2019 at 1:16 p.m. CDT

Mohib Zico gravatar
Ray, It's a good point. I just raised this to our internal team. Let's see what they say...

By Lars Van Casteren user 08 May 2019 at 4:21 p.m. CDT

Lars Van Casteren gravatar
> On a side node, I noticed "otpauth://totp/CompanyName%20Name2%20%20None?", is there a way to change the "None" 's to something else in the generated QR? The OTP script configuration page does not seem to have values to substitute those? This is because the OTP script does: ``` user.getAttribute("displayName") ``` It defaults to 'None' when there's no value, like when using cache-refresh without mapping an attribute to it.

By Mohib Zico staff 19 Jun 2019 at 12:23 p.m. CDT

Mohib Zico gravatar
Gentlemen, Created a [feature request](https://github.com/GluuFederation/oxAuth/issues/1104) on this issue.