private CipherExecutor toTokenCredentialCipherExecutor(final OneTimeTokenAccount account) {
        if (StringUtils.isNotBlank(account.getTenant())) {
            val tenantDefinition = tenantExtractor.getTenantsManager().findTenant(account.getTenant()).orElseThrow();
            val bindingContext = tenantDefinition.bindProperties();
            if (bindingContext.containsBindingFor(GoogleAuthenticatorMultifactorProperties.class)) {
                val properties = bindingContext.value();
                val crypto = properties.getAuthn().getMfa().getGauth().getCrypto();
                return crypto.isEnabled()
                    ? CipherExecutorUtils.newStringCipherExecutor(crypto, OneTimeTokenAccountCipherExecutor.class)
                    : CipherExecutor.noOp();
            }
        }
        return tokenCredentialCipher;
    }
Decode.

@param account the account
@return the one time token account
support/cas-server-support-otp-mfa-core/src/main/java/org/apereo/cas/otp/repository/credentials/BaseOneTimeTokenCredentialRepository.java