OTP OATH Compliant, Event-Based HOTP Tokens & Cards

Event-based OTP tokens use the OATH-HOTP algorithm: each button press creates a new one-time password from a shared secret and a counter, and the code stays valid until it is used. Because the code depends on a counter rather than the time, the token can be used offline. FEITIAN's range includes the C100 keychain token in the I34 casing with IP67 protection and a battery life indicator, the VC-100E wallet-sized display card, and the C300 keypad token, which adds time-based and challenge-response codes. The C100 and VC-100E do not work with Microsoft Entra ID, Azure AD or Azure MFA.

How to Choose an Event-Based OTP Token

  • Keychain or wallet: the C100 hangs on a key ring, and the VC-100E fits in a wallet at 85.6 x 54 x 0.84 mm.
  • One token for HOTP and TOTP systems: the C300 supports both, plus challenge-response and transaction signature.
  • Microsoft environments: choose a time-based token instead, such as the C200 or VC-200E.
  • Seed format: FEITIAN delivers HOTP seeds in Hexadecimal/Plaintext by default, with PSKC available on request.

Frequently Asked Questions

How does an event-based OTP token generate codes?

The token and the authentication server share a secret seed and a counter. Each press of the button on a token such as the C100 moves the counter forward and creates a new OATH-HOTP code, which stays valid until it is used.

Are event-based tokens compatible with Microsoft Entra ID or Azure MFA?

No. According to FEITIAN's product pages, the C100 token and VC-100E card are not supported by Microsoft Entra ID, Azure AD or Azure MFA. If your users sign in through Microsoft, use the time-based C200 or VC-200E, and keep event-based models for the HOTP services on their compatibility lists.

What happens if an event-based token is pressed too many times?

Each press moves the token's counter ahead of the server. If a user presses the button many times without logging in, the token can move beyond the server's look-ahead window, and an administrator or self-service portal resynchronizes it with two consecutive codes. This applies to the C100 and VC-100E alike.

When should I choose an event-based token over a time-based one?

Choose an event-based model when your authentication service lists HOTP tokens such as the C100 or VC-100E as compatible, and you prefer codes that do not expire on a timer. If you run both HOTP and TOTP systems, the C300 covers both in one device.