diff --git a/pkg/apigateway/handler/auth_totp.go b/pkg/apigateway/handler/auth_totp.go
index aa54947ffd..3149ea6c8f 100644
--- a/pkg/apigateway/handler/auth_totp.go
+++ b/pkg/apigateway/handler/auth_totp.go
@@ -27,6 +27,7 @@ import (
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
 
+	"yunion.io/x/onecloud/pkg/apigateway/options"
 	"yunion.io/x/onecloud/pkg/appsrv"
 	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/mcclient"
@@ -42,10 +43,10 @@ import (
 func toQrcode(secret string, token mcclient.TokenCredential) (string, error) {
 	_secret := base32.StdEncoding.EncodeToString([]byte(secret))
 	// https://github.com/google/google-authenticator/wiki/Key-Uri-Format
-	// issuer Onecloud.Domain
-	issuer := "Onecloud"
+	// issuer Cloudpods.Domain
+	issuer := options.Options.TotpIssuer
 	if len(token.GetDomainName()) > 0 {
-		issuer = fmt.Sprintf("Onecloud.%s", token.GetDomainName())
+		issuer = fmt.Sprintf("%s.%s", options.Options.TotpIssuer, token.GetDomainName())
 		issuer = url.PathEscape(issuer)
 	}
 
diff --git a/pkg/apigateway/options/options.go b/pkg/apigateway/options/options.go
index 129f5e285e..cd2408aafc 100644
--- a/pkg/apigateway/options/options.go
+++ b/pkg/apigateway/options/options.go
@@ -26,7 +26,8 @@ type GatewayOptions struct {
 
 	DisableModuleApiVersion bool `help:"Disable each modules default api version" default:"false"`
 
-	EnableTotp bool `help:"Enable two-factor authentication" default:"false"`
+	EnableTotp bool   `help:"Enable two-factor authentication" default:"false"`
+	TotpIssuer string `help:"TOTP issuer" default:"Cloudpods"`
 
 	SsoRedirectUrl     string `help:"SSO idp redirect URL"`
 	SsoAuthCallbackUrl string `help:"SSO idp auth callback URL"`