Weave Code
Laravel One Time Passwords Laravel Package
spatie/laravel-one-time-passwords
Laravel package to generate, send, and verify secure one-time passwords (6-digit OTP by default) via email notifications, extensible to SMS/other channels. Includes a ready-made Livewire login component and optional Flux UI OTP input integration.
Use one time passwords (OTP) to authenticate in your Laravel app
Frequently asked questions about Laravel One Time Passwords
- How do I integrate this package with an existing Laravel authentication system?
- This package is designed to replace or augment your existing auth system. You can override the default `LoginController` or use middleware to enforce OTP-only login. For hybrid flows (e.g., OTP + password), you’ll need to extend the package’s action classes or traits to customize the validation logic. The package assumes OTP is the primary auth method, so hybrid setups require additional logic.
- Can I use this package for multi-factor authentication (MFA) alongside other methods like hardware keys?
- The package itself is built for standalone OTP authentication, but you can combine it with other MFA methods by extending its logic. For example, you could use the package’s `GenerateOneTimePassword` action to send an OTP after a user successfully authenticates with a hardware key. Session binding and validation would need to be managed manually to ensure security.
- What Laravel versions and PHP versions does this package support?
- The package supports Laravel 10 through 13 and requires PHP 8.2+. It is regularly updated to maintain compatibility with the latest Laravel releases, including Livewire 3 and 4. Always check the package’s documentation or `composer.json` for the most up-to-date version requirements before installation.
- How do I customize the OTP length or format (e.g., alphanumeric codes)?
- By default, the package generates a 6-digit numeric OTP, but you can customize this by extending the `GenerateOneTimePassword` action class. Override the `generateCode()` method to return your desired format (e.g., alphanumeric strings). Ensure your changes align with security best practices, such as sufficient entropy and length.
- Does this package support SMS notifications for OTP delivery?
- Yes, the package is notification-channel agnostic and works with Laravel’s built-in notification system. To send OTPs via SMS, use a third-party package like `vonage/laravel-notification-channels` or another SMS provider integrated with Laravel notifications. Configure the channel in `config/otp.php` under the `notifiable` section.
- How do I handle rate limiting for OTP requests to prevent brute-force attacks?
- The package includes built-in rate limiting via Laravel’s `RateLimiter`. If a user exceeds the allowed attempts (configurable in `config/otp.php`), they’ll receive a `RateLimitExceeded` exception. Handle this gracefully in your UI (e.g., display a message and enforce a delay) to avoid user frustration. You can also extend the rate-limiting logic by overriding the `RateLimiter` class.
- What happens if an OTP fails to deliver (e.g., email bounce or SMS failure)?
- The package does not include built-in fallback mechanisms for failed deliveries, but you can implement custom logic. For example, you could log failed attempts, notify admins, or provide a manual recovery option (e.g., a backup code or admin-initiated resend). Extend the `SendOneTimePassword` action to handle these edge cases.
- Can I use this package with Inertia.js or a custom frontend framework?
- Yes, the package is frontend-agnostic and provides simple methods like `sendOneTimePassword()` and `attemptLoginUsingOneTimePassword()` that can be called from any frontend (Blade, Inertia.js, React, etc.). The included Livewire and Flux components are optional, so you’re free to build your own UI or integrate with Inertia.js by calling the package’s methods via API routes.
- How do I audit or log OTP generation and consumption for security or compliance?
- The package does not include built-in audit logging, but you can easily add it by extending the `GenerateOneTimePassword` and `ConsumeOneTimePassword` action classes. Log events like OTP creation, delivery attempts, and successful/failed logins using Laravel’s logging system (e.g., `Log::info()`) or a dedicated audit package like `spatie/laravel-audit-logs`.
- What are the performance implications of using this package at scale (e.g., high traffic)?
- The package is designed to be lightweight and leverages Laravel’s caching and session systems for performance. However, under high load, you may encounter race conditions if multiple OTPs are generated or consumed simultaneously for the same user. Mitigate this by using database transactions or optimistic locking (e.g., `selectForUpdate()`) in your custom logic. The package’s modular design allows you to optimize critical paths.
Weaver
How can I help you explore Laravel packages today?