Configure Input of Time-Based One-Time Password (TOTP)

Qualys Browser Recorder has been enhanced to allow your WAS scans to support two-factor authentication (2FA). This means you can use QBR to automate the input of a time- based one-time password (TOTP) token used for 2FA. The "sendTotp" command is used to provide the values that both QBR and the WAS scan engine need to generate the proper TOTP for your web application

Use the sendTotp command for the form field that accepts input of the TOTP. You will need to configure the sendTotp command in the QBR script to specify the hashing algorithm, the number of digits, the time window in seconds, and the secret key. These values are required to generate the correct TOTP for a given point in time.

With the sendTotp command, every time the script is run, either in QBR or by the WAS engine during a scan, the correct TOTP for that moment in time will be generated and entered into the field.

sendTotp command.

Input Arguments

Parameter	Description
locator	(Required) An element locator.
settingsString	(Required) Accepts these four arguments for token generation. Specify these four arguments in the settingsString parameter as a comma-separated values in this order: Hashing_algorithm: Hashing algorithm to be used for calculating HMAC hash. The valid values are: SHA-1, SHA-256, and SHA-512. Number_of_digits: Number of digits in the token. The standard token length is usually 6 to 8 digits long. Time_window: Number of seconds the token will remain valid, which is usually 30 seconds. Secret_key_in_base32: Base 32 encoded secret key that will be hashed to generate the token. An example of settingsString: "SHA-1, 8, 60, GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ"

Parameter

Description

locator

(Required) An element locator.

settingsString

(Required) Accepts these four arguments for token generation.
Specify these four arguments in the settingsString parameter
as a comma-separated values in this order:

Hashing_algorithm: Hashing algorithm to be used for calculating HMAC hash. The valid values are: SHA-1, SHA-256, and SHA-512.
Number_of_digits: Number of digits in the token. The standard token length is usually 6 to 8 digits long.
Time_window: Number of seconds the token will remain valid, which is usually 30 seconds.
Secret_key_in_base32: Base 32 encoded secret key that will be hashed to generate the token.

An example of settingsString:
"SHA-1, 8, 60, GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ"

Last updated: July, 2026