03. One Time Password

Checklist ref

2AU.03.08

Area
2AU. Authenticate
Wireframe ref

08

Type
Technical Standard
Requirement level
MUST
Participant
Data Holder
Statement

The provided OTP MUST be invalidated after a period of time at the discretion of the Data Holder. This expiry period SHOULD facilitate enough time for the customer to reasonably complete the authorisation process.

Reference

Security Profile: Authentication Flows | CX Research 12, 27

Example

Authenticate: Redirect with One Time Password

Version introduced
1.4.0 or earlier
Date introduced

12 August 2020 or earlier

Date modified

25 February 2022

Status
Active