Adding one time password functionality

[rapterjet2004]

resolve #5657

Tested on these credentials from Tobias. Note: no talk app is available on this server

https://qr.ltd3.nextcloud.com/
Account ready to be handed out:
Username: user1
Password:

🏁 Checklist

• ⛑️ Tests (unit and/or integration) are included or not needed
• 🔖 Capability is checked or not needed
• 🔙 Backport requests are created or not needed: /backport to stable-xx.x
• 📅 Milestone is set
• 🌸 PR title is meaningful (if it should be in the changelog: is it meaningful to users?)

[mahibi]

just for the record to lookup for later. The URL for onetime-login is this format:

nc://onetime-login/user:YOURUSERNAME&password:YOURAPPPASSWORD&server:YOURSERVERURL

[mahibi]

Testing with Sermo i have the following issue:

1. Login with onetime QR (works)
2. remove account in app
3. Login with new onetime QR for same account

Bug:
"Something went wrong" snackbar is shown. Log is:

2026-01-16 10:02:28.650 11291-11470 okhttp.OkHttpClient     com.nextcloud.talk2                  I  {"ocs":{"meta":{"status":"failure","statuscode":403,"message":"could not get one-time app password"},"data":[]}}
2026-01-16 10:02:28.650 11291-11470 okhttp.OkHttpClient     com.nextcloud.talk2                  I  <-- END HTTP (112-byte body)
2026-01-16 10:02:28.650 11291-11470 NetworkLoginDataSource  com.nextcloud.talk2                  E  Error caught at oneTimePasswordRequest: java.io.IOException: Unexpected code Response{protocol=h2, code=403, message=, url=https://.....yourserverurl......com/ocs/v2.php/core/getapppassword-onetime}

It sounds like a server issue so i will merge the PR. Please keep up with the issue until it's clarified and confirmed that nothing has to be changed on mobile side.

@nickvergessen thinks it's a bug on android talk app:

might be that the used session is not a one_time_token
As this also happens without the onetime stuff.. maybe old credentials are still used somewhere

Could you look into this @rapterjet2004 ?

Maybe it's something similar to

• Fix proxy push with multiple account #5715
  so might be worth to
• check where cookies should be removed #5719
  ...?

[rapterjet2004]

@mahibi Error should be fixed now. It seemed to be an issue with the okHttpClient saving internal state between requests. This fix instantiates a new client for each request, which is also what is done in the files app.

[github-actions]

APK file: https://www.kaminsky.me/nc-dev/android-artifacts/5700.apk



To test this change/fix you can simply download above APK file and install and test it in parallel to your existing Nextcloud app.

[github-actions]

Codacy

Lint

Type	master	PR
Warnings	99	102
Errors	0	0

SpotBugs

Category	Base	New
Bad practice	6	6
Correctness	10	10
Dodgy code	54	54
Internationalization	3	3
Malicious code vulnerability	3	3
Performance	4	4
Security	1	1
Total	81	81

Lint increased!

[mahibi]

@mahibi Error should be fixed now. It seemed to be an issue with the okHttpClient saving internal state between requests. This fix instantiates a new client for each request, which is also what is done in the files app.

nice 👍