A TOTP token is a N-digit string, usually 6 digits in length, that can be used only once for authentication and within a very short time window (+-30 seconds from now). The TOTP token is generated from a private key – a uniquely generated hash – that is shared between the user and application.