---
title: 'Tutorial: Use TOTP Hardware Tokens for MFA (RFC 6238) in Access Server (YubiKey)'
canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--hardware-tokens-on-access-server-mfa/
product: Access Server Docs
description: Use hardware tokens such as YubiKey for TOTP-based multi-factor authentication (MFA) in OpenVPN Access Server. Learn how to enable MFA and enroll a hardware token for a secure user login.
---

# Tutorial: Use TOTP Hardware Tokens for MFA (RFC 6238) in Access Server (YubiKey)

## Overview

This tutorial shows how to use hardware tokens, such as YubiKey 5 NFC, Protectimus Slim NFC, or Token2, for multi-factor authentication (MFA) in Access Server using time-based one-time passwords (TOTP).

You'll enable TOTP MFA in Access Server and enroll a hardware token as the authenticator.

## Prerequisites

- A hardware token that supports TOTP (for example, YubiKey 5 NFC).
- Yubico Authenticator installed on your device (Windows, macOS, iOS, or Android).

  > **Note**
  >
  > This guide uses YubiKey as an example. If you use another token, such as Protectimus or Token2, refer to the vendor's documentation for setup instructions.

## Step 1: Enable TOTP MFA on Access Server

TOTP MFA isn't enabled by default. You can enable it globally, per group, or per user. Refer to the steps for your preferred method:

- [Tutorial: Turn On TOTP Multi-Factor Authentication](https://openvpn.net/as-docs/v3/tutorials/tutorial--turn-on-mfa.md)
- [Tutorial: How to Manage TOTP MFA from the Command Line](https://openvpn.net/as-docs/v3/tutorials/tutorial--manage-mfa-cli.md)

> **Important**
>
> TOTP MFA works with [local](https://openvpn.net/as-docs/v3/local.md), [RADIUS](https://openvpn.net/as-docs/v3/radius.md), [LDAP](https://openvpn.net/as-docs/v3/ldap.md), and [PAM](https://openvpn.net/as-docs/v3/pam.md) authentication. It doesn't work with [SAML](https://openvpn.net/as-docs/v3/saml.md) or [PAS-only](https://openvpn.net/as-docs/v3/custom-authentication-system.md) authentication.

## Step 2: Enroll from the Client Web UI

1. Sign in to the Client Web UI.
2. When prompted, note the QR code and enrollment code.
3. Open the **Yubico Authenticator**.
4. Insert or connect your hardware token so it's detected.
5. Click **Add account**.
6. Scan the QR code or enter the enrollment code manually.
7. Confirm the account details, then click **Save**.
8. Enter the six-digit code shown in the authenticator.
9. Click **Confirm Code**.
   - The hardware token is enrolled as a TOTP authenticator.
   - The user account now requires a one-time password during login.

## Step 3: Test your setup

1. Download or use an existing [connection profile](https://openvpn.net/as-docs/v3/connection-profiles.md).
2. Import it into OpenVPN Connect.
3. Start a connection.
4. When prompted, enter the six-digit code from the Yubico Authenticator.
   - ✅ **Pass:** Connection succeeds and displays connection statistics.
   - ❌ **Fail:** Authentication fails → verify MFA is enabled, and the token is enrolled correctly.

If you lose access to your hardware token, you'll need an administrator to reset your MFA enrollment.

---

Prev: [Tutorial: How to Manage TOTP MFA from the Command Line](https://openvpn.net/as-docs/v3/tutorials/tutorial--manage-mfa-cli.md)
Next: [Local Authentication](https://openvpn.net/as-docs/v3/tutorials/local-authentication.md)
Index: https://openvpn.net/as-docs/llms.txt