> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/rdm/knowledge-base/how-to-articles/one-time-password-otp-usage-with-entries.md).

# One-time password (OTP) usage with entries

Configure one-time password source and usage settings on Remote Desktop Manager entries to inject OTP codes at session launch.

Remote Desktop Manager entries can be set up to use a one-time password (OTP) at launch.

In the ***Connection*** – ***One-time password*** section of an entry, select a ***Source*** for the OTP and a ***Mode*** in the ***Usage*** group. Type if needed a ***Combination string***. For the full list of settings of the section, see [One-time password](/rdm/knowledge-base/knowledge-base-articles/entry-settings/common-settings/one-time-password.md).

{% hint style="info" %}
For the ***Copy one-time password*** command to appear in the context (right-click) menu of an entry, an OTP must be configured in the ***Properties*** of the entry, in ***Connection*** – ***One-time password***.
{% endhint %}

### Source

The ***Source*** defines where the OTP of the entry comes from.

#### Configured

The OTP key is configured in the entry itself, in the ***One-time password*** group, with its ***Advanced*** settings. To store an OTP key in an entry of its own, use a [One-time password](/rdm/knowledge-base/knowledge-base-articles/entry-settings/one-time-password.md) entry and one of the linked sources instead.

#### Current session credentials

The ***Current session credentials*** option uses the OTP held by the credentials set in the entry ***Common*** – ***General*** – ***Credentials*** section, such as a linked credential entry, [***My personal credentials***](/rdm/ribbon-menu-bar/file/my-account-settings/my-personal-credentials.md) or ***My privileged account***.

{% hint style="warning" %}
In a team environment, use the ***Linked (vault)*** option with a ***One-time password (OTP)*** credential entry, so that every user of the entry gets the same OTP.
{% endhint %}

#### Inherited

The ***Inherited*** option will climb up the navigation tree until it has access to a set of OTP credentials in a parent folder in the ***Connection*** – ***One-time password*** section. The source that applies is shown under the list.

{% hint style="info" %}
For the ***Source*** inheritance to work, the ***Connection*** – ***One-time password*** – ***Source*** needs to be set to ***Inherited*** for every parent folder until it reaches the desired configuration.
{% endhint %}

#### Linked (vault)

Link your entry to use an existing specific ***One-time password (OTP)*** credential entry from the same vault, selected in the ***Credential entry*** group.

{% hint style="info" %}
To use the ***Linked (vault)*** feature, users must have the ***Connect (execute)*** or ***View password*** permission on the linked credential entry.
{% endhint %}

#### Linked (cross vault)

Link your entry to use an existing specific ***One-time password (OTP)*** credential entry from a different vault, selected in the ***Linked (cross vault)*** group with its ***Vault***. This option is offered when the workspace supports links to other vaults.

{% hint style="info" %}
To use the ***Linked (cross vault)*** feature, users must have the ***Connect (execute)*** or ***View password*** permission on the linked credential entry.
{% endhint %}

#### Linked (user vault) and Find by name (user vault)

When the workspace supports the user vault, the entry can use a ***One-time password (OTP)*** credential entry of the user vault. ***Linked (user vault)*** is offered for entries of the user vault and links a specific credential entry. ***Find by name (user vault)*** is offered for entries of the other vaults and finds, for each user, the credential entry of their user vault whose name matches the ***Search*** field.

#### No entry configuration

By default, the OTP ***Source*** of an entry is set to ***No entry configuration***. In this state the entry is not linked to any OTP credentials.

#### Prompt

The ***Prompt*** option opens a window that asks the user to enter the OTP code every time the session launches.

### Usage

The ***Mode*** of the ***Usage*** group defines how the OTP code is affixed. The group is not shown with the ***No entry configuration*** source. Here is the list of possible actions:

* ***None***: No action is done. This is the default setting.
* ***Append to the password***: Affix the OTP after the password.
* ***Prepend to the password***: Affix the OTP before the password.
* ***Specific to session***: If selected, the OTP will, if it applies, be used in a manner specific to the session being launched (not all sessions support OTP).

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>The following sessions are supported by OTP: OpenVPN, SophosVPN, FTP, SFTP, SCP, SSH Tunnel, Telnet, Portforward, and SSH Shell. Please note that the <em><strong>OTP prompt string</strong></em> setting must be configured for all sessions to run, with the exception of OpenVPN and SophosVPN.</p></div>
* ***Inherited***: Will climb up the navigation tree until it has access to a ***Usage*** setting in a parent folder in the ***Connection*** – ***One-time password*** section. For the ***Usage*** inheritance to work, the ***Mode*** needs to be set to ***Inherited*** for every parent folder until it reaches the desired configuration.
* ***Append to the username***: Affix the OTP after the username.
* ***Prepend to the username***: Affix the OTP before the username.
* ***Append and use push notifications***: Affix the ***Push string*** after the password instead of a code, for services that send a push notification to approve the sign-in. When the ***Push string*** field is empty, `,push` is used.

With the append and prepend modes, the ***Combination string*** is placed between the credential and the OTP code, for example as a separator.

#### See also

* [Devolutions Academy - Configuring and Managing Credential Entries](https://academy.devolutions.net/student/path/1916054/activity/2667052)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/rdm/knowledge-base/how-to-articles/one-time-password-otp-usage-with-entries.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.