---
title: 'Tutorial: Use YubiKey as TOTP MFA token'
canonical: https://openvpn.net/connect-docs/tutorials/tutorial--use-yubikey-as-totp-mfa-token/
product: OpenVPN Connect Docs
description: Use a YubiKey as a TOTP MFA token with OpenVPN Connect. Learn how to enroll your hardware token and securely connect using one-time passwords.
---

# Tutorial: Use YubiKey as TOTP MFA token

## Overview

This tutorial shows how to use a YubiKey as a time-based one-time password (TOTP) authenticator when connecting with OpenVPN Connect.

You’ll enroll your YubiKey with your VPN account and use it to generate one-time codes during login.

> **Tip**
>
> This tutorial is for users connecting to [Access Server](https://openvpn.net/access-server/). For other VPN providers or servers, ensure your configuration supports TOTP MFA.

## Prerequisites

- An [Access Server with TOTP MFA enabled](https://openvpn.net/as-docs/v3/tutorials/tutorial--turn-on-mfa.md).
- An [OpenVPN Connect profile configured for your user](https://openvpn.net/as-docs/v3/tutorials/tutorial--create-connection-profiles.md).
- A YubiKey (or compatible hardware token with TOTP support).
- Yubico Authenticator installed on your device.

> **Note**
>
> If TOTP MFA isn't turned on for your account, contact your administrator.

## Step 1: Enroll your YubiKey

1. Open a web browser and sign in to the [Client Web UI](https://openvpn.net/as-docs/v3/client-web-ui-user-manual.md).
2. When prompted, note the QR code and enrollment code.
3. Open the **Yubico Authenticator**.
4. Insert or connect your YubiKey.
5. Click **Add account**.
6. Scan the QR code or enter the enrollment code manually.
7. Confirm the account details, then click **Save**.
8. Enter the six-digit code shown in the authenticator.
9. Click **Confirm Code**.
   - Your YubiKey is enrolled now as a TOTP authenticator.
   - The user account now requires a one-time password during login.

## Step 2: Connect using OpenVPN Connect

1. Open OpenVPN Connect.
2. Start your VPN connection.
3. Enter your username and password.
4. When prompted for MFA:
   - Open **Yubico Authenticator**.
   - Insert or tap your YubiKey (if required).
   - Enter the six-digit code.
5. The VPN connection starts after successful authentication.

## Tips

- TOTP codes refresh every 30 seconds.
- Always use the latest code displayed.
- Keep your YubiKey accessible when connecting.

## Troubleshooting

| **Issue** | **Resolution** |
| --- | --- |
| Code not accepted | Wait for a new code and try again. |
| No MFA prompt | Confirm MFA is enabled for your account. |
| YubiKey not detected | Reinsert the device or reopen Yubico Authenticator. |

---

Prev: [Tutorial: Turn On Seamless Tunnel to Ensure Secure Internet Browsing](https://openvpn.net/connect-docs/tutorials/tutorial--turn-on-seamless-tunnel-to-ensure-secure-internet-browsing.md)
Index: https://openvpn.net/connect-docs/llms.txt