First Factor One-Time Passwords for Laravel with OTPZ

OTPZ is a Laravel package created by Ben Bjurstrom (author of Prezet) that provides secure first-factor one-time passwords (OTPs) for Laravel applications. This allows users to enter their email addresses and receive a one-time code to sign in instead of a password.

#Key Features

• Rate-limited
• Configurable expiration times
• Invalidate OTP after its first use
• Lock the OTP to the user's session
• Invalidate the OTP after too many failed attempts
• View detailed error messages
• Customize the mail template used
• Auditable logs

To setup, install the package via composer:

composer require benbjurstrom/otpz

Then publish and run the included migrations:

php artisan vendor:publish --tag="otpz-migrations"
php artisan migrate

Next, add the package's interface and trait to your Authenticatable User model

<?php
// app/Models/User.php
namespace App\Models;
 
//...
use BenBjurstrom\Otpz\Models\Concerns\HasOtps;
use BenBjurstrom\Otpz\Models\Concerns\Otpable;
 
class User extends Authenticatable implements Otpable
{
    use HasFactory, Notifiable, HasOtps;
 
    // ...
}

And lastly add the package provided routes in your routes/web.php file:

Route::otpRoutes();

Optionally, you may publish the default views and config to customize things further:

php artisan vendor:publish --tag="otpz-views"
php artisan vendor:publish --tag="otpz-config"

The package works with Laravel Breeze with either Livewire or Inertia, and further instructions are provided on how to update the respective LoginRequest::authenticate method with a send email method to run the SendOtp action.

If you are looking for a way to quickly allow users secure and temporary or single-use access to a system, then OTPZ might be the package for you.

Learn more about this package and view the source code on GitHub.