Otpz Laravel Package

Product Decisions This Supports

• Passwordless / OTP authentication features: OTPz gives you a ready-made primitive for generating, storing, expiring, and verifying one-time passcodes — the kind of flow behind "email me a login code," step-up verification before a sensitive action (changing email, deleting an account, approving a payment), or account recovery.
• Build vs. buy on auth primitives: The core value is avoiding a bespoke OTP implementation. Token generation, hashing, expiry windows, single-use semantics, attempt throttling, and constant-time comparison are exactly the details teams get wrong. Adopting the package removes that surface area and the associated security review burden.
• Internationalization roadmap: The v0.7.0 localization addition is the most product-relevant change. It means the OTP messages and delivery copy can be translated, which unblocks launching in non-English markets without forking the package or wrapping every string.
• Framework upgrade planning: Laravel 13 support (also new in v0.7.0) means the package will not be the blocker on your next framework upgrade. That's a roadmap input for when you can safely schedule the Laravel bump.
• Reliability of the OTP data model: The nullable ip_address fix addresses a class of migration/insert failures in environments where a request IP isn't available (queued jobs, CLI, certain proxy setups). If OTPs are ever generated outside a normal HTTP request, this removes a silent breakage risk.
• Use cases to prioritize: email-based login codes, 2FA second factor, invite/verification codes, and one-time links for destructive actions.

When to Consider This Package

• Adopt when you are on Laravel and need a focused, email-oriented OTP flow; you want a small, single-responsibility dependency rather than a full auth starter kit (Breeze/Jetstream/Fortify) that brings scaffolding you don't need; and you want the security-sensitive parts (hashing, expiry, throttling) handled by maintained code rather than internal glue.
• Adopt with translation requirements now that v0.7.0 ships localization — this is the release that makes it viable for multi-locale products.
• Look elsewhere or build on top when you need SMS/voice/multi-channel delivery orchestration, complex per-user policy engines, risk scoring, or enterprise IAM/SSO. OTPz is a primitive, not an identity platform; combine it with a delivery layer rather than expecting it to own channel routing.
• Mind the maturity signal: the package is still pre-1.0 (v0.7.0). Version-pin it, watch the changelog for breaking changes on minor bumps, and treat the public API as not yet frozen. The release also shows a growing contributor base (three first-time contributors here) — positive for bus-factor, but the project is still small; keep an exit path if you embed it deeply.
• Check fit against your threat model: confirm the hashing, expiry, and rate-limit defaults meet your security bar before committing; a nullable-column fix and localization don't change the underlying security posture, so do that review once at adoption.

How to Pitch It (Stakeholders)

To executives: We can ship passwordless/OTP login and step-up verification faster and more safely by using a small, Laravel-native package instead of building and maintaining that logic ourselves. The latest release adds localization (unlocks non-English markets) and Laravel 13 support (keeps us upgrade-ready), plus a fix that removes a reliability failure mode. Net: lower build cost, smaller security surface, and no framework-upgrade blocker — with the caveat that it's a pre-1.0 dependency we should version-pin and monitor.

To engineering: OTPz owns the fiddly, easy-to-get-wrong parts of OTP — generation, hashing, expiry, single-use enforcement, throttling — behind a clean Laravel API. v0.7.0 makes the ip_address column nullable (safe for jobs/CLI/proxied contexts), adds localization for user-facing messages, and adds Laravel 13 compatibility. Adopt it as an OTP primitive, not an auth framework; pair it with your own delivery/channel layer for SMS or multi-channel needs, and pin the minor version given pre-1.0 semantics.