5.11. Token info

When you select one token, you can choose “Token Info” to view details about the selected token.

In the Web UI you can click the button above the token view tab.


Detailed information about the token can be viewed in the Token Info dialog

The displayed information reflect the database token table.

This is the internal database id of the token.

This is a field that holds many additional information like the type of the hash library used with the OATH algorithm or special information about time based TOTP tokens.

Here you will also find information, how often a token was successfully used to authenticate and how often a user tried to authenticate with this token.

Also in this field the validity period of the token is stored. The validity period determines till when a token may be used and starting from which date a token may be used. E.g. this is used for the lost tokens (see Lost token).

It is possible to display the time a token was used last.


To activate this functionality an API call is needed which configures the format of the date:
https://LINOTP/system/setConfig?token.last_access='Accessed: %d, %b,%Y'&session=COOKIE

Valid format strings are:

  • %d is the day number
  • %m is the month number
  • %b is the month abbreviation
  • %y is the year last two digits
  • %Y is the all year

Detailed information about the API can be found in System Controller and https://linotp.org/doc/api/linotp.html.

This is the length of the OTP value. The OTP value will be truncated to this length. Also, during authentication this value is used to split the entered credential into the OTP PIN and the OTP value.

This is the internal type of the token. The type determines the TokenClass, that will be used to calculate the OTP value.

The list of the supported types is constantly increasing. Those types can be: HMAC, TOTP, mOTP, SMS, SPass, RADIUS, Remote, VASCO…


The type only specifies the type of algorithm to validate the OTP value or the way to distribute the OTP value. So the type “hmac” can be an SafeNet eToken PASS, a Feitian Token, a YubiKey and any other soft token, that uses the hmac (HOTP) algorithm.


This is a unique serial number of this very token.

The serial number also usually indicates the type of the token.

For OATH compliant tokens the first two letters specify the vendor.


KeyIdentity’s own tokens will always start with “LS”.

The next two letters may specify the type of the token like:

  • LSSP: KeyIdentity Simple Pass token
  • LSRE: KeyIdentity REmote token
  • LSRA: KeyIdentity RAdius token
  • LSOC: KeyIdentity OCra token
  • LSSM: KeyIdentity SMs token
This is the window where the LinOTP server searches a matching counter to validate the OTP value.
This settings corresponds with the Failcount. The Failcount gets increased, when the user fails to authenticate with this token. When the Failcount reaches MaxFail the user can not authenticate with this token anymore. (see Reset fail counter)
is a variable field that gets blended in from the UserIdResolver. The contents depends on the specific UserIdResolver implementation.
Realm names
This is the list of realms in which the token is put.
This is the counter of event based tokens.
This is the username (login name) of the user to whom the token is assigned.
When doing a resync (either manually or automatic) the fitting counter is searched for in this window.
see MaxFail

This is the token description. Using the API it is possible to set the description to some thing of your needs. This is usually set to some kinds like “web enrolled”, “temporary replacement” or if it is an SMS token to the mobile phone number.

This field has no functional purpose.

This is the unique identifier to find the user in the given UserIdResolver.
This is the UserIdResolver, where to user, to whom the token is assigned, is located.
This is the unique identifier to find the user in the given UserIdResolver.
This is the flag that indicates it the token is enabled or disabled.