SecTrail Authenticator
SecTrail Authenticator is the mobile authentication application of the SecTrail MFA infrastructure. It runs on iOS, Android and Huawei devices; it lets users generate one-time codes, approve incoming sign-in requests via push notification or number matching, and sign in without a password using a QR code.
The application also works as a standard TOTP (RFC 6238) client; accounts from services outside SecTrail (Google, Amazon, Microsoft, etc.) can be kept in the same application.
This documentation is based on SecTrail Authenticator v1.4.9.
What Can Be Done with the Mobile Application?
The authentication methods and helper features supported by the application are listed below.
Authentication Methods
| Feature | Description | Registration Required? | Internet Required? |
|---|---|---|---|
| Soft OTP (TOTP) | Generates a 6-digit code that refreshes every 30 seconds | Yes | No |
| Push Notification | Approving/rejecting the sign-in request via notification | Yes | Yes |
| Number Matching (v2.1+) | Approving by entering the number shown on the sign-in screen | Yes | Yes |
| QR Login | Passwordless sign-in by scanning the QR code on the screen | Yes | Yes |
| Passkey (FIDO2) | Device-bound passwordless credential provider | Yes — Registration Panel (WebAuthn) | Yes |
| Third-Party TOTP | Standard TOTP accounts such as Google, Amazon, etc. | Yes — the QR of the relevant service | No |
Helper Features
- App Lock: PIN code and/or biometric authentication (fingerprint, face recognition)
- Remote Security Configuration: The administrator enforcing PIN/biometric requirements centrally
- Google Drive Backup: Backing up and restoring accounts in encrypted form
- Notification History: A record of all incoming authentication requests (approved / rejected / timed out)
- Multiple Account Support: Managing multiple organization and user accounts in a single application
- Device Security Check: Refusing to run on compromised devices through jailbreak/root detection
Account Types
The application keeps two different account types. Which type is created is determined automatically based on the format of the scanned QR code.
SecTrailMFA Type
These are corporate accounts registered to the SecTrail MFA server. They are created through the Registration Panel.
Supported features:
- ✅ Soft OTP code generation
- ✅ Receiving and approving push notifications
- ✅ Approving with number matching (v2.1+)
- ✅ QR login
- ✅ Remote security configuration
Custom Type
These are accounts of third-party services that use standard TOTP (Google, Amazon, GitHub, etc.).
Supported features:
- ✅ Soft OTP code generation
Push notification, number matching and QR login require the device to be registered to the SecTrail server. This registration is performed only for accounts of the SecTrailMFA type. Custom accounts work entirely on the device, offline.
System Requirements
| Platform | Minimum Version | Store |
|---|---|---|
| iOS | iOS 15.0 | App Store |
| Android | Android 5.0 (API 21) | Google Play Store |
| Huawei | Android 5.0 (API 21) | Huawei AppGallery |
The passkey (FIDO2) feature requires newer operating system versions: iOS 17.0+ or Android 14 (API 34)+. On devices below this threshold the feature is not visible in the application.
Device Requirements:
- Camera (for QR code scanning)
- Internet connection (for push notification, number matching, QR login and passkey)
- Notification permission (for push notification and number matching)
- Bluetooth (if signing in from another device with a passkey)
- Correct system time (for the validity of Soft OTP codes)
For push notification, number matching, QR login and passkey features to work, outbound access to cs.sectrail.com over port 443 (HTTPS) must be open on the corporate network.
This access is not required for Soft OTP — codes are generated entirely on the device, offline.
How Does It Work?
The application performs authentication in two different ways.
1. By Generating a Code (Soft OTP)
The application shows a 6-digit code for each account that refreshes every 30 seconds. While signing in, you type this code into the relevant field.
Codes are generated entirely on your phone — no internet connection is required.
2. By Approving an Incoming Request
When you sign in to an application, a notification arrives on your phone. The notification states who made the sign-in, from where and when. The sign-in is not completed until you approve it.
This method has two forms:
| Form | How is it approved? |
|---|---|
| Push Notification | You tap the Approve button in the notification |
| Number Matching | You type the number shown on the sign-in screen into the application |
Number matching works the same way as push notification; the only difference is that approval is given by entering a number instead of a single tap. This extra step prevents you from accidentally approving a sign-in request that does not belong to you — if you are not looking at the sign-in screen, you cannot know the correct number.
Your organization's administrator decides which form is used.
Your device must have an internet connection for notifications to reach your phone and for your response to be processed. Soft OTP, on the other hand, works offline.
Security Features
- Device Integrity: The application does not open and shuts itself down on devices where jailbreak (iOS) / root (Android) is detected
- App Lock: Access to the application can be restricted with PIN and biometric authentication
- Passkey Keys: Private keys are stored in the device's hardware vault and never leave the device
Next Steps
🔗 Registration
Account registration through the Registration Panel and manual registration.
Registration Guide →Related Pages
- Registration Panel: The web panel where mobile application registration is performed
- Soft OTP: TOTP profile and policy configuration
- Push Notification: Push profile and policy configuration
- QR Login: QR login profile configuration