Laravel Advanced OTP

Laravel Advanced OTP is a package designed for flexible OTP (One-Time Password) verification, supporting both hashed token verification and custom validation methods. It allows for easy OTP handling for tasks like email-based authentication.

---

Features

• Hashed Token Verification: Secure OTP validation using hashed tokens.
• Custom Validation: Developers can use their own validation methods (e.g., database or cache-based).
• Configurable OTP Settings: Custom timeout and OTP length.

Installation

Install the package via Composer:

composer require mkd/laravel-advanced-otp

Create your own OTPMethod

php artisan magic-otp:make LoginOTP

Usage

1. OTP Generation and Email Sending (Hashed Token)

In this example, a hashed token is used to securely send and verify the OTP.

// Generate OTP and send it via email
$otp = \LaravelAdvancedOTP::handle(LoginOTP::class, [
    'secret' => 'secret_key',  // Required to hash and verify OTP
    'email' => '[email protected]',  // Email of the recipient
]);

// Get the hashed token for verification
$token = $otp->getHashedKey();

// Send OTP to user's email
$otp->send('[email protected]');

// Return the hashed token for later verification
return response()->json(['token' => $token]);

2. OTP Generation Without Hashed Token

If you want to handle the OTP validation manually (e.g., store it in a database or cache), you can omit the hashed token.

// Generate and send OTP without hashed token
\LaravelAdvancedOTP::handle(LoginOTP::class)->send('[email protected]');

3. Verifying OTP (Hashed Token)

Use the hashed token to validate the OTP.

$otp = request('otp');
$hashedToken = request('token');  // Token returned when sending OTP

$signature = [
    'secret' => 'secret_key',  // Same secret used during OTP generation
    'email' => '[email protected]',
];

// Verify the OTP using the hashed token
$otpStatus = \LaravelAdvancedOTP::verify(LoginOTP::class, $otp, $signature, $hashedToken);

if ($otpStatus == OTPStatusEnum::NOT_VERIFIED) {
    // OTP is invalid
}

if ($otpStatus == OTPStatusEnum::VERIFIED) {
    // OTP is valid
}

if ($otpStatus == OTPStatusEnum::EXPIRED) {
    // OTP has expired
}

4. Verifying OTP (Custom Validation)

If you want to handle OTP validation manually, you can use your custom logic for verification.

$otp = request('otp');
$email = request('email');

// Custom validation for OTP
$otpVerified = \LaravelAdvancedOTP::validate(LoginOTP::class, $otp, $email);

if ($otpVerified) {
    // OTP is valid
} else {
    // OTP is invalid or expired
}

Custom OTP Class

To implement your OTP logic, create a class extending MagicOTP. Here is an example:

class LoginOTP extends MagicOTP
{
    protected int $timeout = 120;  // Timeout in seconds
    protected int $otpLength = 5;  // Length of the OTP

    public function send($email)
    {
        $otp = $this->getOTP();
        // Logic to send OTP via email
    }

    public function validate($otp, $email)
    {
        // Logic to validate OTP for the email
    }
}

Configuration

You can adjust the default settings like OTP timeout, length, and more by customizing your OTP class.

Changelog

Please see CHANGELOG for more information what has changed recently.

Contributing

Please see CONTRIBUTING for details.

Security

If you discover any security related issues, please email [email protected] instead of using the issue tracker.

Credits

• Mustafa Khaled
• All Contributors

License

The MIT License (MIT). Please see License File for more information.