UserOTPLogin Plugin
UserOTPLogin adds a time-based one-time password (TOTP) step to AVideo login.
An administrator first enables the plugin in Admin → Plugins. Each user then enrolls from the OTP/security option in My Account.
OTP (One-Time Password) is an additional security layer for your account. It requires you to enter a unique 6-digit code from an OTP app on your mobile device every time you log in. This ensures that even if someone knows your password, they cannot access your account without the OTP.
-
Download an OTP App: First, download and install an OTP app of your choice on your mobile device. Below are some popular options available for both Android and iOS:
- Google Authenticator (Android) / App Store Link (iOS)
- Authy (Android & iOS)
- Microsoft Authenticator (Android & iOS)
- Duo Mobile (Android & iOS)
- LastPass Authenticator (Android & iOS)
- FreeOTP (Android & iOS)
-
Scan the QR Code: After enabling the OTP feature on your account, a QR code will be displayed. Open your OTP app and choose the option to add a new account, then scan the QR code.
-
Manually Enter the Key (Optional): If you're unable to scan the QR code, you can manually enter the provided secret key into your OTP app.
-
Validate the OTP: Once the OTP app is set up, it will generate a 6-digit code. Enter this code on the OTP setup page to validate and activate OTP for your account.
-
Access OTP Settings: You can manage your OTP settings anytime from the "My Account" section.
-
Reset OTP Key: If you want to reset your OTP key (e.g., if you lose your device), you can do so. This will generate a new secret key, and you'll need to reconfigure the OTP app on all your devices. Note: Resetting the key will invalidate all previously configured devices.
-
Invalidate OTP Sessions: If you suspect unauthorized access or wish to log out from all devices, you can invalidate the OTP sessions. This will require you to log in again with your password and OTP code.
-
Skip OTP Setup: If you decide not to use OTP, you can skip the setup. However, this will make your account less secure. You can always enable OTP later if you change your mind.
Once OTP is enabled, login asks for the current 6-digit code generated by the enrolled authenticator app.
Why is every code rejected? Set the phone and server clocks to automatic time, then retry the current code before resetting enrollment.
What if the phone is lost? Use the site's documented recovery/admin process. Resetting the OTP secret invalidates codes on previously enrolled devices.
May I share the QR code or secret? No. Anyone with it can generate valid codes; reset the secret if it is exposed.
