Weave Code
Otp Laravel Package
delight-im/otp
A PHP library for generating and verifying one-time passwords, with support for time-based and counter-based OTPs, configurable code lengths and HMAC algorithms, and simple APIs for adding two-factor authentication to Laravel or any PHP application.
One-time password (OTP) implementation for two-factor authentication with TOTP in accordance with RFC 6238 and RFC 4226
Frequently asked questions about Otp
- How do I install delight-im/otp in a Laravel application?
- Install it with Composer using composer require delight-im/otp after confirming the package's PHP constraints on Packagist. Then wrap the library in a Laravel service provider or your own TwoFactorService rather than calling it directly from controllers or models. Validate the dependency footprint and autoloading in your Laravel/PHP matrix before adopting it.
- Is delight-im/otp a Laravel 2FA package or just an OTP library?
- It is a framework-agnostic PHP primitive for HOTP and TOTP, not a Laravel-native 2FA package. It does not provide Laravel controllers, middleware, migrations, user flows, or configuration out of the box. In Laravel, treat it as a low-level OTP engine behind an application-owned service.
- Can I use delight-im/otp for TOTP and HOTP in Laravel?
- Yes, the library is intended for time-based TOTP and counter-based HOTP in line with RFC 6238 and RFC 4226. It can be used inside Laravel, but the framework integration, user state, and security controls must be built by your application. Confirm the public API and test vectors before relying on it.
- How should I configure code length, period, and HMAC algorithm with delight-im/otp?
- The package supports configurable code lengths, HMAC algorithms, and OTP modes, so you should centralize these values in Laravel configuration rather than hard-coding them. Verify the exact API and defaults for period, digits, and SHA1/SHA256/SHA512 support in the version you install. Keep the adapter interface narrow so you can replace the library without rewriting your authentication flow.
- Does delight-im/otp handle secret generation, QR codes, and recovery codes?
- No, delight-im/otp is only the OTP primitive; it does not visibly provide enrollment, QR provisioning, recovery codes, rate limiting, audit logging, or encrypted secret storage. Laravel applications must add those operational pieces themselves. Store OTP secrets with Laravel encryption and design recovery and lockout flows before production.
- How do I test delight-im/otp against RFC 6238 and RFC 4226 test vectors?
- Start with a time-boxed spike and run the RFC 6238 and RFC 4226 test vectors against the library's TOTP and HOTP output. Confirm the version's test coverage and add negative-path tests for invalid codes, clock skew, and replay attempts. Do not rely on the package's own tests alone for a security-sensitive roll-out.
- What Laravel and PHP versions does delight-im/otp support?
- The package is framework-agnostic, so there are no Laravel-specific constraints to guide compatibility. You must validate its Composer PHP constraints against your supported Laravel and PHP matrix, along with PSR-4 autoloading and dependency footprint. Because it has no Laravel integration, your application owns the configuration and lifecycle behavior.
- Is delight-im/otp safe for production two-factor authentication?
- Treat it as high technical risk by itself: it is a small primitive with low adoption signals and no visible security review or operational surface. It can be production-safe only if your team owns secret encryption, enrollment, recovery, rate limiting, audit logging, replay checks, and monitoring. Run a security due diligence and pilot behind a feature flag before customer-facing use.
- How do I prevent clock skew, replay, and rate-limit issues with delight-im/otp?
- Verify how the installed version handles time drift and replay, because TOTP libraries often leave replay prevention and throttling to the application. In Laravel, implement rate limiting, one-time-use tracking, lockout monitoring, and a documented clock-skew policy around the OTP service. Monitor OTP failure rates, enrollment completion, recovery-code usage, and lockout volume.
- What are alternatives to delight-im/otp for Laravel 2FA, and what if it is abandoned?
- Compare maintained Laravel 2FA packages and consider forking or vendoring delight-im/otp because the codebase is small and community-only support carries no SLA. If you adopt it, assign an internal owner for upgrades, security patches, and compatibility testing. Keep an adapter interface so you can replace or fork the underlying OTP engine without rewriting flows.
Weaver
How can I help you explore Laravel packages today?