Duo (recently acquired by Cisco) is a provider of unified access security and multi-factor authentication delivered through the cloud. Its services can be used with HOTP and TOTP hardware tokens, and since there is no automatic resync mechanism available, Duo recommends to use HOTP, although it supports TOTP as a protocol, without time drift adjustment. 

TOTP token drift and resynchronization are not supported. As a result, imported TOTP tokens may not work for authentication with Duo Security, or may fail to work for authentication after a variable period of time.

While HOTP hardware tokens are recommended, they are still subject to become out of sync and may need to be manually resynced.

Tokens can get "out of sync" if the button is pressed too many times in a row and the generated passcodes aren't used for login. Contact your administrator if your token stops working.

To avoid the issues above, you can benefit from our programmable tokens with unrestricted time sync. When using this type of tokens, the resync operations can be performed by users without the need of involving the service administrators. The hardware clock sync can be done using the TOKEN2 NFC Burner applications, available for Android and Windows platforms, via NFC protocol. 

Refer to this article for instructions on how to import TOTP hardware tokens to your DUO account.