Does TOTP-based two-factor authentication support bitwarden

[Terrorb1ade]

Sorry to bother you!
I update npm to the latest version v2.13.6, then paste the secret key into bitwarden and it gives me a verification code, but when I enter the verification code back to npm, it shows Invalid verification code, I don't understand what is going on...

[piotrfx]

Hi @Terrorb1ade ,

Thanks for reaching out! To answer your question: yes, Bitwarden is essentially doing the same thing as Google Authenticator. Both use the TOTP (Time-based One-Time Password) protocol. However, since the code is calculated based on the current time, the most common reason for an "Invalid verification code" error is a time synchronization mismatch.

Here are a few things you can check to resolve this:

Server vs. Device Time Sync:

NPM (the server) and Bitwarden (your device) must have their clocks perfectly synced. Even a 30-second difference can cause the code to be rejected.

On your device: Ensure your time is set to "Automatic" in your system settings.

On the NPM Server: Check your server's system time. If you are running NPM in Docker, ensure the container's time zone and clock match the host (check your docker-compose for TZ variables or volume mounts for /etc/localtime).

Secret Key Precision:

When you pasted the secret key into Bitwarden, ensure there were no accidental trailing spaces or missing characters. It’s often safer to delete the entry in Bitwarden and re-add it by scanning the QR code if possible, or very carefully re-copying the text string.

Bitwarden Vault Sync:

Sometimes the Bitwarden extension/app hasn't fully synced with the cloud. Try manually syncing your vault before copying the next code.

Try a Different Authenticator (Test):

To rule out a Bitwarden-specific bug, try adding the same secret key to a different app (like Raivo, 2FAS, or Google Authenticator). If it fails there too, the issue is definitely the server's system time.

Let us know if syncing the server clock fixes it for you! If not, I can look into it :).

[piotrfx]

If will work, here are my next steps:

The Plan: I am preparing a PR to make the 2FA implementation more robust. Here is how I plan to address this:

Increased Tolerance (Code Fix): I will update the backend to allow a "window" of 1 (±30 seconds). This provides a 90-second grace period for slight time drifts between the server and your device without compromising security.

UI Guidance (UX Fix): I will add a hint in the 2FA setup modal to remind users that their server time must be synchronized via NTP if they encounter "Invalid code" errors.

Toggle Option (Optional): I am considering adding a "Compatibility Mode" toggle for users who need a wider time-sync window, though a default 30s grace period usually fixes 99% of these cases.

Temporary Workaround for you: Please check the system time on your NPM server (e.g., run date in your terminal) and compare it to time.is. If they don't match, sync your server clock using NTP, and the Bitwarden codes should start working immediately.

Once we know the outcome, we can plan the solution.

[Terrorb1ade]

If will work, here are my next steps:

The Plan: I am preparing a PR to make the 2FA implementation more robust. Here is how I plan to address this:

Increased Tolerance (Code Fix): I will update the backend to allow a "window" of 1 (±30 seconds). This provides a 90-second grace period for slight time drifts between the server and your device without compromising security.

UI Guidance (UX Fix): I will add a hint in the 2FA setup modal to remind users that their server time must be synchronized via NTP if they encounter "Invalid code" errors.

Toggle Option (Optional): I am considering adding a "Compatibility Mode" toggle for users who need a wider time-sync window, though a default 30s grace period usually fixes 99% of these cases.

Temporary Workaround for you: Please check the system time on your NPM server (e.g., run date in your terminal) and compare it to time.is. If they don't match, sync your server clock using NTP, and the Bitwarden codes should start working immediately.

Once we know the outcome, we can plan the solution.

Thank you for replying

I have been using Bitwarden for a long time, and have added 6 verification codes:

they all work perfectly, so i am confused why npm can't work...

[Terrorb1ade]

Thanks again for replying.
I had done what you said exactly, I'm pretty sure all times are synchronized correctly.
Besides, I re-login GitHub and noip using verification codes, they both work, but npm still not working...

[Terrorb1ade]

I used google authenticator to scan the QR code, and entered the verification code Google authenticator gave me, guess what, it does not work!

[Terrorb1ade]

If will work, here are my next steps:

The Plan: I am preparing a PR to make the 2FA implementation more robust. Here is how I plan to address this:

Increased Tolerance (Code Fix): I will update the backend to allow a "window" of 1 (±30 seconds). This provides a 90-second grace period for slight time drifts between the server and your device without compromising security.

UI Guidance (UX Fix): I will add a hint in the 2FA setup modal to remind users that their server time must be synchronized via NTP if they encounter "Invalid code" errors.

Toggle Option (Optional): I am considering adding a "Compatibility Mode" toggle for users who need a wider time-sync window, though a default 30s grace period usually fixes 99% of these cases.

Temporary Workaround for you: Please check the system time on your NPM server (e.g., run date in your terminal) and compare it to time.is. If they don't match, sync your server clock using NTP, and the Bitwarden codes should start working immediately.

Once we know the outcome, we can plan the solution.

plz add Tolerance Window.

[piotrfx]

Hello, I'll make several tests here on several networks, not just broadband, and, if PR can be accepted withthe proposed change, I will increase it to 90 seconds (industry standard in many cases). I'll try to do it over the weekend. I'll comment here once I'll do it.

Thank you for your feedback :).

[Hackpig1974]

I found where the configuration is on the profile menu. I will give it a try.

[piotrfx]

@Hackpig1974 , I've added 2FA in #5109 . You can find it in the dev branch, though. That's what I've been told. I didn't check recent code changes here, sorry. My copy is still on my GH here https://github.com/piotrfx/nginx-proxy-manager. This one we use in the production and this one works like a charm :).

[Hackpig1974]

I was able to get it working on this latest build release. Super easy to setup once I found it. I assumed it would have been added to EDIT- USER, but I found it in the upper right dropdown. I am using Vault Warden self-hosted with the Bitwarden Client on my IOS device. Created the TOTP and it accepted the code on login. I was presented with the backup code as well. Very nice.

Only suggestion would be when logging in with TOTP to put an expiration if possible for when to be re-prompted for the token again. So like 30 days or 2 weeks, 1 week, etc.. Not that I don't like dragging my phone out each time. :-)

[piotrfx]

@Hackpig1974 I'll take your take into consideration for sure. Let's wait for others, maybe more feedback can be provided :). I'm happy to contribute, but, from my experience, it's best for others to test before making any changes.