Time-Based One-Time Passwords for Phone Support

Phone Support Gets Time-Based One-Time Password Authentication

Cloudflare is now offering Enterprise customers a way to authenticate over the phone without going through support tickets. Previously, sensitive account details were never discussed over the phone; now eligible customers can prove their identity using a token generated either from the Cloudflare dashboard or via a standard TOTP authenticator app like Google Authenticator.

When a customer calls support and provides their email address, they can then supply a single-use token to verify their identity during the call. This enables support representatives to assist with more account-specific issues over the phone while maintaining security.

Setting Up Phone Authentication

Existing Enterprise customers interested in this capability should contact their Customer Success Manager to confirm eligibility and complete setup. Those exploring the Enterprise offering can begin through the Enterprise plan page.

Once enabled, users can generate tokens in two ways:

• Single-Use Token: Generated directly from the Cloudflare dashboard's support page, useful for authenticating just one call.
• Authenticator App: Configure a standard 2FA app to generate remote tokens on demand for ongoing use.

On the support page, users will find a card labeled "Emergency Phone Support Hotline – Authentication" where both options are available. Detailed step-by-step guidance is documented in the "Emergency Phone" section of Cloudflare's Contacting Cloudflare Support knowledge base article.

How Token Generation Works

The system uses the standardized approach for Time-Based One-Time Passwords (TOTPs) defined in RFC 6238, the same mechanism commonly used for two-factor authentication on websites. In typical TOTP setups, a QR code or alphanumeric string provides a shared secret between the authenticator app and the web service. Password generation then combines this secret with Unix time — integer divided by a validity period, commonly 30 seconds — and passes both through a cryptographic hash function. The hexadecimal output is truncated to decimal digits shown to the user. Thanks to the avalanche effect, even a one-second change in the timestamp yields a drastically different output.

A standard authenticator setup requires a shared secret stored on both client and server. Cloudflare's implementation deviates here: because users can also generate a token from the dashboard where no shared secret exists, the service generates single-use tokens by hashing an internal user ID with a Cloudflare-internal secret. This produces RFC 6238-compliant TOTPs without storing additional secrets for each user. The token is surfaced every 30 seconds via a JavaScript request, without ever exposing the underlying secret.

Why Not Reuse Login 2FA Tokens?

There are two key reasons Cloudflare's phone authentication doesn't simply rely on the 2FA tokens used during login. First, users should never get into the habit of providing their login 2FA codes to anyone — those are strictly for authentication at sign-in. Second, Cloudflare recently added WebAuthn security key support for logging in; since those are physical USB tokens, they aren't practical for use with a mobile phone during a support call.

The service also accounts for real-world user experience: tokens are validated in the previous time step in case one expires while a caller reads it aloud, which RFC 6238 permits for network delays. Effectively, a token remains valid for up to one minute.

All APIs behind this feature are wrapped with gateways that provide audit logging for both customer actions and staff member actions, creating a clear trail of every authentication event.

Evolution of Support Authentication

Authentication tooling must evolve alongside the channels customers use to reach support — from web forms behind logins, to JWT tokens for validated live chat sessions, and now TOTP-based phone authentication. This is paired with human oversight: technical support engineers can still route certain issues back to traditional support tickets, and cases requiring additional approval can be referred to named customer success managers.

Cloudflare plans to build on this foundation by adding a callback request feature to the dashboard for Enterprise phone support, so users can request that an agent call them rather than waiting in a queue.