System Design

TOTP Authentication Architecture

System Design diagram · made in Skemio

Authentication architecture showing mobile app and server deriving matching TOTP codes from shared secret and time counters, validated through a Redis replay cache.
Authentication architecture showing mobile app and server deriving matching TOTP codes from shared secret and time counters, validated through a Redis replay cache.
Open it in SkemioMake your own

What it shows

  • RFC 6238 derives tokens from HMAC-SHA1(Secret, Floor(Time / 30s))
  • Servers evaluate T-1, T0, and T+1 steps to absorb client clock drift
  • Tokens get blacklisted on use to stop replay attacks within windows

The takeaway

TOTP is stateless math: shared symmetric secrets paired with synchronized epoch time counters.

More system design diagrams