iOS 15 Password Manager / Authenticator opens on all "otpauth://" URL's without the "apple-" prefix

When attempting to open an otpauth://totp URL on iOS 15 Beta 8 it opens the Password Manager.

Based on the documentation & the tagged WWDC session it should only open the iOS Password Manager if the URL contains the apple- prefix.

For example: apple-otpauth://totp

This is currently breaking our Multi Factor Authentication setup flow. Will this behaviour be changed for the next beta & iOS 15 release?

Replies

I'm running into this same issue. Not only does it open the native iOS Password Manager, it won't allow you to add a new account.

You always have to add it to an existing account, which means that any user who doesn't have their login credentials already stored in iOS Password manager, they're unable to setup 2FA with this link.

Is this expected to be fixed in iOS 15? Is there something else we need to be doing with the otpauth urls?

I'm running into the issue with this URL as a sample: otpauth://totp/github.com:?secret=&issuer=github.com&algorithm=SHA1&digits=6&period=30

(you can repro by clicking on this link from Notes app or iMessage app)

Same issue here 👍

Also, when clicking any otpauth:// or apple-otpauth:// link on macOS Monterey Safari Version 15.1 (17612.2.9.1.20) - Safari asks for permission to open System Prefs, then System Preferences crashes and quits unexpectedly.

Here's my crash log when clicking something like this on macOS / Safari 15.1 (17612.2.9.1.20)

  • Same issue here with the released version of macOS Monterey.

Add a Comment

To be clear, this is when clicking a link like this:

otpauth://totp/dev.hiddenloop.com:my@email.com?secret=XDEPTHW44WK7WW6D&issuer=dev.hiddenloop.com

Or with the apple prefix

apple-otpauth://totp/dev.hiddenloop.com:my@email.com?secret=XDEPTHW44WK7WW6D&issuer=dev.hiddenloop.com

Has this issue been fixed yet or has a workaround been found?