farayaz / laravel-otp
simple otp for laravel
Maintainers
Requires
- php: ^8.1
- illuminate/container: ^10.0|^11.0|^12.0|^13.0
- illuminate/database: ^10.0|^11.0|^12.0|^13.0
- illuminate/support: ^10.0|^11.0|^12.0|^13.0
Requires (Dev)
- laravel/pint: ^1.0
- orchestra/testbench: ^8.0|^9.0|^10.0|^11.0
- phpunit/phpunit: ^10.5|^11.0|^12.0
README
Usage
$otp = OTP::generate('user@example.com'); OTP::isValid('user@example.com', $otp->code); // checks without consuming OTP::validate('user@example.com', $otp->code); // checks and consumes atomically
All rejected OTPs (wrong, expired, already used, or attempt-locked) throw the same
Farayaz\LaravelOtp\Exceptions\LaravelOtpException with the message Invalid OTP.
Publish the optional configuration file with:
php artisan vendor:publish --tag=laravel-otp-config
It configures the default code length (6), validity in minutes (5), and maximum
failed attempts (3). Explicit generate() arguments take precedence over these
defaults. Supported OTP lengths are 3 through 10 digits, and validity must be a
positive integer number of minutes.
Upgrading
Run php artisan migrate after upgrading. The additive package migration adds the
persistent attempts column and a unique identifier index. Test installations with
duplicate identifier rows must remove those duplicates before migrating. Generating
an OTP then atomically replaces the existing OTP state for that identifier.
Compatibility
- Laravel 10
- Laravel 11
- Laravel 12
- Laravel 13