To automate a website’s TOTP challenge, generate a time-based one-time password in your test code, then enter it through the page like any other form field. Playwright and Puppeteer provide browser automation—not a built-in TOTP generator. Use a dedicated test account and secret, match the site’s TOTP settings, and submit the code while it is still valid.
How does TOTP fit into a browser test?
TOTP is a time-based form of the HMAC-based One-Time Password algorithm (HOTP): the prover and verifier calculate a code using a shared secret and a time-derived moving factor. The IETF’s RFC 6238 specifies a 30-second default time step, but an application can configure different supported parameters. The application’s actual settings—not the RFC default alone—determine what your test must generate.
As an Amazon Associate I earn from qualifying purchases.
- Provision a dedicated account in the test environment and enroll a test-controlled TOTP secret through the application’s supported setup flow.
- Keep the secret outside the repository, available only to the test runner through protected CI configuration or a secrets manager.
- Use a maintained TOTP implementation in the test process. Configure it to match the application’s secret encoding, HMAC algorithm, digit count, and time period.
- Sign in through the normal page flow, generate the code near the moment you need it, enter it in the OTP field, and submit.
- Assert that the account reached an authenticated state, using a page condition rather than an arbitrary fixed delay where possible.
The framework handles navigation, input, and submission. Your test code—or a library it uses—handles TOTP generation.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsHow do I handle TOTP in Playwright?
Playwright’s authentication guide covers saving and reusing browser state after login; that workflow does not generate TOTP codes. If the test needs to exercise MFA, generate a code separately and fill the challenge form with ordinary page interactions.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
After a successful login, Playwright can save browser state for tests that do not need to repeat authentication. That can reduce repeated sign-ins, but it also means those tests do not exercise the login or MFA flow. State files can contain cookies and headers capable of impersonating an account, so store them in an ignored, access-controlled location, keep them out of version control, and limit their lifetime where practical.
How do I enter a TOTP code with Puppeteer?
Puppeteer’s Page.authenticate() sets credentials for HTTP authentication; it is not a generator for a website’s TOTP challenge. For an OTP prompt in the page, generate the code separately and interact with the form using normal page controls. The documented API notes that Page.authenticate() enables request interception behind the scenes, which can affect performance; it is not a substitute for handling a site’s second-factor form.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
How can I prevent expiry-related test failures?
A TOTP code depends on time. RFC 6238 gives 30 seconds as the default time step, not a universal guarantee that every website accepts a code for exactly that long. The verifier’s configured acceptance window is authoritative for the application under test.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Keep the test runner’s clock synchronized with a reliable time source.
- Generate the code close to submission rather than before navigation or a long wait.
- Prefer explicit waits for the OTP challenge and its readiness over fixed sleeps.
- Account for time spent entering the code, network delay, and any clock drift the application allows.
- Check rate limits and account lockouts, especially if failures are repeated.
- Avoid concurrent tests sharing one account or relying on the same code at the same time.
If a test fails intermittently, check the generator’s parameters and secret encoding, runner time, code age at submission, and the account’s lockout or rate-limit state. Do not weaken production verification to make automation pass; use controlled test-account settings in a test environment.
Rank #3
- Ultra-Compact FIDO2 Security Key – Plug-and-stay or carry on a keychain. This USB-C hardware security key offers portable, always-on protection for desktop and mobile use.(Item Size: 0.73 X 0.60 X 0.30 inches)
- USB-C Hardware Key for All Devices – Works with USB-C ports on PC, Mac, Android, and USB-C iPhones. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key – Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey – Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication – Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Should tests repeat TOTP login or reuse authenticated state?
| Approach | What it covers | Trade-off |
|---|---|---|
| Repeat login with TOTP | Exercises the sign-in and MFA flow | Requires a controlled secret, correct TOTP parameters, and submission within the verifier’s acceptance window. |
| Reuse authenticated browser state | Lets tests begin after login | Can avoid repeated sign-ins, but does not test MFA and creates a sensitive state artifact. |
Choose based on what the test is meant to verify. Playwright notes that shared authentication state may not suit tests that mutate server-side state or require browser-specific authentication; see its authentication guidance before sharing state across tests.
Is Playwright’s virtual authenticator the same as TOTP?
No. Playwright’s virtual authenticator documentation concerns WebAuthn credential ceremonies, such as passkeys. TOTP instead uses a shared secret and time-derived code. Configure the test mechanism to match the product’s actual second factor; a WebAuthn authenticator is not a replacement for generating a TOTP code.
Rank #4
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How should you protect TOTP secrets and test state?
A TOTP seed is a credential: anyone who obtains it may be able to generate codes for the associated account. RFC 6238 says each prover should have a unique secret and that keys must be protected. NIST’s SP 800-63-4 authenticator guidance states that OTP authentication is not phishing-resistant and addresses protected secrets, validity periods, replay resistance, and rate limiting. These are properties of the verifier and account design; browser automation should not bypass them.
- Use dedicated test accounts and test-only secrets, not employee or customer credentials.
- Restrict secret access to the test runner and keep seeds out of source control, logs, screenshots, traces, and build artifacts.
- Protect saved browser state as carefully as credentials because it may allow account impersonation.
- Use the application’s test-account process to rotate or reset secrets.
- Run these tests only against systems and accounts your team owns or is authorized to test.
How do you validate a TOTP implementation?
Test the generator separately from the browser flow. Compare its output against the published test vectors in RFC 6238 Appendix B, then exercise the real challenge form with an authorized test account. Review whether the selected library supports the application’s parameters, is maintained, and can be pinned under your project’s dependency policy. No one package is established as universally preferred.
Quick Recap
Best Value
- FIDO2/Passkey Authentication – Secure, passwordless login with supported platforms. Check if your intended service supports hardware keys before purchase. Works with Gmail, Facebook, GitHub, Dropbox, and more.
- Enhanced Multi-Factor Authentication (MFA): Strengthen account security using either FIDO2.0 authentication or TOTP/HOTP codes, providing flexible options for added protection.
- Universal Connectivity: Features USB-A and NFC compatibility, making it easy to use across various devices including PCs, Macs, iPhones, and Android phones for seamless integration.
- Durable & Portable Design: Built with a 360° rotating metal cover for extra durability. Compact and lightweight, it easily attaches to a keychain for on-the-go convenience. No batteries or network required, ensuring dependable use anywhere.
- FIDO Certified & Business-Ready: Certified for FIDO standards and supported by a range of management software suites, ideal for both individual users and enterprise deployment.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
