- How do I install and set up otpz for passwordless login in Laravel?
- Install the package with Composer, then publish its config, migrations, views, and language files as needed. Run the migration and either use the generated request and verify routes/controllers or call the OTP service directly from your own flow. It is designed for a first-party email-code login flow with minimal setup.
- Which Laravel versions does benbjurstrom/otpz support?
- Version 0.7.0 widened the illuminate/* constraint to add Laravel 13 support. You should still compare your app version against the package composer.json and check the CI-tested matrix rather than relying only on the declared constraint. Pin the exact package version you validate against.
- How does otpz generate and validate one-time passwords?
- The package provides migration-backed storage for OTP codes plus routes and controllers for requesting and verifying them. It generates secure one-time passwords, stores them, and validates submitted codes with expiry and rate-limiting controls. Delivery is mail-based by default.
- Can I use otpz for email verification or two-factor authentication?
- otpz fits first-party flows such as passwordless login step-up, email verification, and low-assurance two-factor authentication. It is not a general authentication framework and does not provide TOTP, WebAuthn, SMS failover, or per-tenant policy configuration. If those capabilities are on your roadmap, expect to wrap or fork it.
- How do I configure OTP expiry and rate limiting in otpz?
- Publish the package config file and review the expiry and throttling options before exposing the request and verify endpoints. These controls help limit repeated code requests and ensure codes are short-lived. Test the resulting behavior against your application’s login and abuse-prevention requirements.
- Does otpz send OTP codes by email, and can I customize the messages?
- Yes, otpz assumes mail as the delivery channel and ships with publishable views and language files. You can publish and customize the user-facing copy, but you then own the tone and completeness of every OTP message. Review error and rate-limit strings as well as the happy path.
- I upgraded otpz and ip_address is not nullable. What migration should I run?
- The nullable ip_address change in v0.7.0 fixes the published migration stub, but it is not retroactive for applications that already published migrations. Existing deployments need an explicit hand-written ALTER or change() migration to make the column nullable where intended. Do not rely on re-publishing the package migration to fix an existing database.
- Does otpz support localization for OTP emails and errors?
- Version 0.7.0 adds publishable language assets, so localization is available for new adopters. You should confirm whether the shipped files cover error paths such as expired, throttled, invalid, and already-used codes. Once published into your app, your team owns the translations and copy.
- Is otpz stable for production, and how often are there breaking changes?
- otpz is still pre-1.0, so minor releases can include breaking changes under semver. Pin exact versions and treat upgrades as reviewable changes rather than routine patch updates. The package also reads as primarily single-maintainer, so consider bus factor and security-response expectations.
- How does otpz compare to TOTP, WebAuthn, or full identity providers?
- otpz is narrowly scoped to email-delivered one-time passwords inside a Laravel application. Choose it when you want a simple email-me-a-code flow without adopting a full identity provider. For TOTP, WebAuthn, SMS delivery, or per-tenant policy configuration, look at broader authentication packages or expect to build around otpz.