tzsk/otp

Install the package via Composer to use it in your PHP or Laravel project.

composer require tzsk/otp

To use the package outside of Laravel, you must instantiate a manager by providing a filesystem path where the package can store its data.

Note: Ensure the directory you provide is secured via your web server configuration (e.g., Apache or Nginx) to prevent unauthorized access to the OTP data.

Unlike Laravel, which uses the default cache store, non-Laravel usage requires an explicit path to a directory.

// 1. Initialize with a storage directory
$manager = otp('./otp-tmp');

// 2. Configure and Generate
$manager->digits(6);
$manager->expiry(20);
$otp = $manager->generate($unique_secret);

// 3. Match (must use same config)
$valid = $manager->digits(6)->expiry(20)->match($otp, $unique_secret);

If you are using Laravel, publish the configuration file to customize default OTP settings using the following Artisan command:

php artisan otp:publish

The Otp class implements __call to provide several semantic aliases for its primary methods. This allows for more expressive code depending on your preference:

In Laravel, you can interact with the package using the Tzsk\Otp\Facades\Otp facade.

Important Security Requirement: The configuration used during generation (number of digits and expiration time) must match exactly during verification. If you change these settings during generation, you must apply the same settings when matching the OTP, otherwise verification will fail.

use Tzsk\Otp\Facades\Otp;

// Basic usage
$otp = Otp::generate($unique_secret);
$valid = Otp::match($otp, $unique_secret);

// Custom configuration
$otp = Otp::digits(8)->expiry(30)->generate($unique_secret);
$valid = Otp::digits(8)->expiry(30)->match($otp, $unique_secret);

In Laravel, you can use the global otp() helper function as a shorthand for the Facade.

$otp = otp()->make($secret);
$otp = otp()->digits(8)->expiry(20)->make($secret);

Use the generate(string $key) method to create a new One-Time Password. The method generates a secure secret, stores it in the underlying cache repository with an expiration time, and returns the calculated OTP string. The $key is a unique identifier (e.g., a user ID or email) used to associate the OTP with a specific context.

Note: You can also use the aliases make() or create() to perform the same action.

$otp = $otpService->generate('user-id-123');

The Otp class allows you to fluently configure the lifespan and length of the generated codes using the following methods:

• expiry(int|string $expiry): Sets the expiration time in minutes. For example, passing 10 sets the expiry to 600 seconds. This method returns $this for chaining.
• digits(int|string $digits): Sets the number of digits for the generated OTP. This method returns $this for chaining.

$otpService->expiry(5)->digits(6);

Use the forget(string $key): bool method to manually invalidate and remove the OTP associated with a specific $key from the cache store.

$otpService->forget('user-id-123');

Use the check(mixed $code, string $key): bool method to verify if a provided code matches the stored OTP for a given $key.

• The $code can be a string or an integer.
• If the code is valid, the method returns true and automatically removes (forgets) the OTP from the store to prevent reuse.
• If the code is invalid or expired, it returns false.

Note: You can also use the aliases match() or verify() to perform the same action.

$isValid = $otpService->check('1234', 'user-id-123');

if ($isValid) {
    // Proceed with verification
}

Use the otp:publish Artisan command to publish the package's configuration file to your application's config directory. This command internally triggers the vendor:publish command using the otp-config tag.

php artisan otp:publish