> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Modify hardware token settings

Use this page to configure policy values for standard hardware token authentication. These settings affect how long token responses remain valid and how much variation is allowed during authentication and reset operations.

## Modify hardware token settings in IDaaS

Before you make large changes, test with a small user group. If the allowed time is too short, more users can fail sign-in. If the allowed time is too long, security risk can increase.

1. Click Menu icon **>** **Policies > Authenticators**. The **Authenticators** page appears.

2. Select the **Hardware Token** tab. The **Hardware Token** settings appear.

3. Set the **Max. Time Steps** to the amount of time (in `30` second intervals) that the token response is valid. The default is `10` (`5` minutes).

4. Set the **Max. Reset Time Steps** to the amount of time (in `30` second intervals) for a token reset. The default is `120` (`60` minutes), which is the allowable time difference between the token and the server clocks.

5. For event-based tokens (HOTP tokens), configure the following settings:

6. Set **Max Event Window** to the numbers of token responses that are searched to find a matching user response during authentication.

   > The value entered must be less than the **Max Reset Event Window**. The value must be between `1` and `25`. The default value is `10`.

7. Set **Max Reset Event Window** to the number of token responses that are searched to find a matching user response during a token reset operation. The value must be between `1` and `100`. The default value is `80`.

note
If the token reset does not work, depending on the type of token you are using, try increasing the **Max. Reset Time Steps** or **Max. Reset Event Window** and then try to reset the token again. If the problem continues, call the Entrust customer support team.

8. Click **Save** to confirm changes to your Hardware Token authenticator settings.

### Validate your changes

After you save, verify the following:

1. A test user can complete normal token authentication with the configured **Max. Time Steps** and **Max Event Window** values.
2. Token reset succeeds with the configured **Max. Reset Time Steps** and **Max Reset Event Window** values.
3. Authentication failure rates do not increase unexpectedly after the policy change.

info

To use a TokenCR (Token Challenge/Response) hardware token, you additionally need to create a custom user login authentication flow that uses **Token/Challenge Response** for second-factor authentication. See [Create authentication flows](/docs/authentication-and-security/create-and-manage-resource-rules/create-authentication-flows.md).