Oracle Mobile Authenticator

The registration screen asks for a QR code or a manual setup key. No account from outside Oracle's identity domain works. The app does not let you browse or explore without adding an account first. This is not a general-purpose authenticator. It is a locked portal for Oracle Cloud users and enterprise employees who have already been provisioned through their organization's identity domain. The moment you tap "Add Account," you are committing to a workflow that many users later find irreversible.

Once an account is added, the dashboard shows a list of your linked accounts. Each account displays a rotating six-digit code that refreshes every 30 seconds. The "Approve" button appears when a push notification arrives. You tap it to confirm a login attempt. The app works offline. It does not need an internet connection to generate codes. But it does need one to receive push notifications. This creates a split experience. Offline, you get codes. Online, you get approvals. Both modes work, but neither offers a way to recover your accounts if you lose your phone.

How the offline OTP generation and the no-backup policy actually work together

The offline OTP generation is not a standalone feature. It depends on a secret key stored locally on your device. When you scan a QR code or enter a manual key, that key is saved in the app's local storage. The app uses that key to generate TOTP codes per RFC 6238. No internet connection is required. This is convenient for users in areas with poor connectivity. But it creates a critical vulnerability. If you lose your device, or if you uninstall the app, that secret key is gone. There is no cloud backup. There is no export option. There is no migration tool. The only recovery path is to contact your identity domain administrator and ask them to reset your authentication factors. This is not explained on the Play Store page. The store description presents offline OTP generation as a feature. In practice, it is a trap. Users who lose their device lose access to their Oracle Cloud account with no way to recover it themselves.

However, the offline feature has a catch. The app also supports push notifications. These require an internet connection. When you approve a login via push notification, the app sends a signal to Oracle's servers. This is convenient. But it also means that if you are offline, you cannot approve push notifications. You must use the OTP code instead. This creates a workflow where users must remember which method to use based on their connectivity. The app does not guide you. It just presents both options and leaves you to figure it out.

What the changelog actually changed

The version history shows sparse updates. The latest changelog mentions "fixed with account logo crash and sync issue." This is the only change described. No details on what caused the crash. No explanation of what was synced. The previous versions are similarly vague. The app has not seen a significant feature update in years. Users report that the app crashes after updates. They report that sync issues persist. The changelog does not address the lack of backup. It does not address the QR code scanning failures. It does not address the compatibility issues with other authenticators. The app remains a bare-bones implementation that works for basic use but fails when users need it most.

The technical detail that stops the workflow

The app requires storage permission to save the secret keys. If you deny storage access, you cannot add an account. The permission is requested during the first account setup. If you skip it, you cannot enable it later from within the app. You must go to your device settings, find Oracle Mobile Authenticator, and manually grant storage permission. After that, you can scan the QR code. But the app does not refresh the account list automatically. You have to close and reopen the app to see the new account. This manual refresh is the final action you take before the app stops providing new information.