> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/windows-workstation-mfa/authentication-methods/password-+-otp.md).

# Password + OTP

<figure><img src="/files/bN3AEHWs5NaeWUWvW90K" alt="Password + OTP Login user Journey"><figcaption></figcaption></figure>

***

### Admin Setup

Before users can authenticate with Password + OTP, configure an Adaptive Auth Journey in AdminX.

1. Log in to AdminX as a community administrator.
2. Navigate to **Applications > Windows MFA > Adaptive Auth Journeys**.
3. Click **Add new adaptive auth journey**.
4. Provide a journey name and define conditions (by user, group, or machine name).
5. Set the Action to **MFA Required**.
6. Select one of the following authentication methods depending on which OTP source you want to allow:

| Method                       | OTP Source                                  |
| ---------------------------- | ------------------------------------------- |
| Password & any OTP           | 1Kosmos app TOTP, SMS, Email, or Voice call |
| Password & 1Kosmos App Codes | 1Kosmos mobile app TOTP only                |
| Password & SMS OTP           | SMS to registered mobile number             |
| Password & Email OTP         | Email to registered email address           |
| Password & Voice OTP         | Voice call to registered phone number       |

7. Click **Save**.

{% hint style="info" %}
&#x20;For SMS, Email, and Voice OTP, the user's phone number or email address must be present on their Active Directory profile. If the attribute is missing, the option will not be presented to the user at login.
{% endhint %}

#### User Guide — Logging in with Password + OTP

1. On the Windows login screen, click the **1Kosmos** tile.
2. If using the **Other User** tile, enter your username and click **Submit**.
3. On the **Choose an authentication method** screen, click **Password**.
4. Enter your Active Directory password and click the arrow to proceed.
5. On the **Enter your verification code** screen, enter the OTP from your chosen source:
   * **1Kosmos app** — open the app and use the TOTP code displayed
   * **SMS** — click **Send Code via SMS** and enter the code received
   * **Email** — click **Send Code via Email** and enter the code received
   * **Voice** — click **Send Code via Call** and enter the code received
6. Press **Enter**. You will be logged into Windows.

{% hint style="info" %}
If you enter an incorrect OTP more than the maximum number of attempts configured by your administrator, your account will be locked. Contact your help desk to unlock it.
{% endhint %}

#### Troubleshooting

| Issue                                    | Likely Cause                                                  | Resolution                                    |
| ---------------------------------------- | ------------------------------------------------------------- | --------------------------------------------- |
| OTP option not appearing at login        | No journey configured, or journey does not include OTP method | Check AdminX auth journey configuration       |
| SMS / Email / Voice option not appearing | Phone number or email not on AD profile                       | Add the attribute to the user's AD profile    |
| OTP code rejected                        | Code expired (TOTP codes are time-sensitive)                  | Generate a new code and try again immediately |
| Account locked after failed attempts     | Max OTP attempts exceeded                                     | Contact help desk to unlock                   |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/authentication/windows-workstation-mfa/authentication-methods/password-+-otp.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.