otplib

https://github.com/yeojz/otplib
Admin
otplib is a JavaScript library for generating and verifying Time-based (TOTP) and HMAC-based (HOTP)...
Tokens:147,123
Snippets:977
Trust Score:9.2
License:MIT
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Install @otplib/preset-v11

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/v11-adapter.md

Install the adapter package via npm.

```bash
npm install @otplib/preset-v11
```

--------------------------------

### Install otplib-cli and check help

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/cli.md

Shows global installation and running via npx without installation. Both commands display help.

```bash
# Global install
npm install -g otplib-cli
otplibx --help
otplib --help

# Run as needed (no install required)
npx -p otplib-cli otplibx --help
npx -p otplib-cli otplib --help
```

--------------------------------

### Install otplib for Bun or Deno

Source: https://github.com/yeojz/otplib/blob/main/packages/otplib/README.md

Install otplib for Bun or Deno runtimes. Use the appropriate command for your runtime.

```bash
bun add otplib
deno install npm:otplib
```

--------------------------------

### Install @otplib/plugin-base32-alt

Source: https://github.com/yeojz/otplib/blob/main/packages/plugin-base32-alt/README.md

Install the plugin using npm, pnpm, or yarn.

```bash
npm install @otplib/plugin-base32-alt
pnpm add @otplib/plugin-base32-alt
yarn add @otplib/plugin-base32-alt
```

--------------------------------

### Install @otplib/v12-adapter

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/v12-adapter.md

Install the v12 adapter package to use v13 internals with the v12 synchronous API.

```bash
npm install @otplib/v12-adapter
```

--------------------------------

### Install @otplib/plugin-base32-scure

Source: https://github.com/yeojz/otplib/blob/main/packages/plugin-base32-scure/README.md

Install the plugin using npm, pnpm, or yarn. Choose the command that matches your package manager.

```bash
npm install @otplib/plugin-base32-scure
pnpm add @otplib/plugin-base32-scure
yarn add @otplib/plugin-base32-scure
```

--------------------------------

### Install @otplib/hotp

Source: https://github.com/yeojz/otplib/blob/main/packages/hotp/README.md

Install the @otplib/hotp package using npm, pnpm, or yarn.

```bash
npm install @otplib/hotp
pnpm install @otplib/hotp
yarn add @otplib/hotp
```

--------------------------------

### Install @otplib/core

Source: https://github.com/yeojz/otplib/blob/main/packages/core/README.md

Install the @otplib/core package using npm, pnpm, or yarn. Choose the command that matches your package manager.

```bash
npm install @otplib/core
pnpm add @otplib/core
yarn add @otplib/core
```

--------------------------------

### Install otplib-cli globally

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/tools/cli.md

Install the otplib-cli command-line tool globally via npm. This is the recommended installation method for using the CLI.

```bash
npm install -g otplib-cli
```

--------------------------------

### Node.js: Use @otplib/plugin-crypto-node

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/runtime-compatibility.md

Recommended setup for Node.js using the native node:crypto plugin. Requires installing @otplib/plugin-crypto-node and @otplib/plugin-base32-scure.

```typescript
import { generate, verify, generateSecret } from "otplib";
import { crypto } from "@otplib/plugin-crypto-node";
import { base32 } from "@otplib/plugin-base32-scure";

const secret = generateSecret({ crypto, base32 });
const token = await generate({ secret, crypto, base32 });
```

--------------------------------

### Install @otplib/totp

Source: https://github.com/yeojz/otplib/blob/main/packages/totp/README.md

Install the @otplib/totp package using npm, pnpm, or yarn. Choose the command that matches your package manager.

```bash
npm install @otplib/totp
pnpm install @otplib/totp
yarn add @otplib/totp
```

--------------------------------

### Install @otplib/preset-v11 with npm, pnpm, and yarn

Source: https://github.com/yeojz/otplib/blob/main/packages/v11-adapter/README.md

Install the adapter package using your preferred package manager. The commands are equivalent alternatives for adding the dependency.

```bash
npm install @otplib/preset-v11
pnpm add @otplib/preset-v11
yarn add @otplib/preset-v11
```

--------------------------------

### Install @otplib/plugin-crypto-web with npm, pnpm, or yarn

Source: https://github.com/yeojz/otplib/blob/main/packages/plugin-crypto-web/README.md

Install the plugin using your preferred package manager. Choose one of the three commands.

```bash
npm install @otplib/plugin-crypto-web
```

```bash
pnpm add @otplib/plugin-crypto-web
```

```bash
yarn add @otplib/plugin-crypto-web
```

--------------------------------

### Install @otplib/plugin-crypto-node

Source: https://github.com/yeojz/otplib/blob/main/packages/plugin-crypto-node/README.md

Install the plugin using npm, pnpm, or yarn.

```bash
npm install @otplib/plugin-crypto-node
pnpm add @otplib/plugin-crypto-node
yarn add @otplib/plugin-crypto-node
```

--------------------------------

### Installation commands for @otplib/plugin-crypto-noble

Source: https://github.com/yeojz/otplib/blob/main/packages/plugin-crypto-noble/README.md

Install the plugin using npm, pnpm, or yarn. Choose the command that matches your package manager.

```bash
npm install @otplib/plugin-crypto-noble
pnpm add @otplib/plugin-crypto-noble
yarn add @otplib/plugin-crypto-noble
```

--------------------------------

### Install otplib in Bun

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/runtime-compatibility.md

Install otplib in Bun using the standard npm package manager command.

```bash
bun add otplib
```

--------------------------------

### Example otpauth:// URI

Source: https://github.com/yeojz/otplib/blob/main/packages/uri/README.md

A concrete example of an otpauth:// URI for a GitHub account using TOTP.

```text
otpauth://totp/GitHub:user@example.com?secret=GEZDGNBVGY3TQOJQGEZDGNBVGY&issuer=GitHub
```

--------------------------------

### Install @otplib/uri with npm, pnpm, or yarn

Source: https://github.com/yeojz/otplib/blob/main/packages/uri/README.md

Install the @otplib/uri package using your preferred package manager. The commands are equivalent alternatives.

```bash
npm install @otplib/uri
```

```bash
pnpm add @otplib/uri
```

```bash
yarn add @otplib/uri
```

--------------------------------

### Install otplib for Node.js

Source: https://github.com/yeojz/otplib/blob/main/packages/otplib/README.md

Install otplib for Node.js using npm, pnpm, or yarn. Choose one command based on your package manager.

```bash
npm install otplib
pnpm add otplib
yarn add otplib
```

--------------------------------

### Install otplib main package

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/getting-started.md

Installs the main otplib package, which works across Node.js, browsers, and edge environments out of the box.

```bash
npm install otplib
```

--------------------------------

### Start Development Server

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/README.md

Starts the VitePress development server. Run `pnpm dev` from the apps/docs directory or `pnpm docs:dev` from the project root. The site will be available at http://localhost:5173.

```bash
# Start development server
pnpm dev

# Or from root
pnpm docs:dev
```

--------------------------------

### Complete Example with Database

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/advanced-usage.md

A complete example of implementing replay protection in a real application. It retrieves the user's secret and last time step, verifies the token with afterTimeStep, and updates the last time step on success.

```typescript
import { verify } from "otplib";
import { Database } from "your-database";

const db = new Database();

async function login(userId: string, token: string): Promise<boolean> {
  // Get user's secret and last used time step
  const { secret, lastTimeStep } = await db.getUser(userId);

  // Verify token with replay protection
  const result = await verify({
    secret,
    token,
    afterTimeStep: lastTimeStep, // Reject previously used time steps
  });

  if (result.valid) {
    // Update last used time step to prevent reuse
    await db.updateLastTimeStep(userId, result.timeStep);
    return true;
  }

  return false;
}

// Usage
const success = await login("user-123", "123456");
if (success) {
  console.log("Login successful!");
} else {
  console.log("Invalid token or token already used");
}
```

--------------------------------

### Clone and install otplib

Source: https://github.com/yeojz/otplib/blob/main/CONTRIBUTING.md

Clones the otplib repository and installs dependencies using pnpm. Requires Node.js >= 24.11.0 and pnpm >= 11.26.0.

```bash
# Clone the repository
git clone https://github.com/yeojz/otplib.git
cd otplib

# Install dependencies
pnpm install
```

--------------------------------

### Before (v12) usage

Source: https://github.com/yeojz/otplib/blob/main/packages/v12-adapter/README.md

Example of using the v12 API before migrating.

```typescript
import { authenticator } from "otplib";

const secret = authenticator.generateSecret();
const token = authenticator.generate(secret);
const isValid = authenticator.verify({ token, secret });
```

--------------------------------

### Install individual otplib packages

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/getting-started.md

Installs individual otplib modules for smaller bundle sizes or platform-specific optimizations. Includes core functionality, Node.js and browser crypto plugins, Base32 encoding, and error types.

```bash
# Core functionality
npm install @otplib/core @otplib/totp

# For Node.js
npm install @otplib/plugin-crypto-node

# For browsers
npm install @otplib/plugin-crypto-web

# For Base32 encoding
npm install @otplib/plugin-base32-scure

# For Error types and Core utilities
npm install @otplib/core
```

--------------------------------

### Bun/Deno: Use @otplib/plugin-crypto-noble

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/runtime-compatibility.md

Recommended setup for Bun and Deno using the pure JS noble crypto plugin for consistent cross-runtime behavior.

```typescript
import { generate, verify, generateSecret } from "otplib";
import { crypto } from "@otplib/plugin-crypto-noble";
import { base32 } from "@otplib/plugin-base32-scure";

const secret = generateSecret({ crypto, base32 });
const token = await generate({ secret, crypto, base32 });
```

--------------------------------

### otplib CLI Commands

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/cli.md

Documentation for the otplib CLI commands, including input format, options, and examples.

```APIDOC
## otplib encode

### Description
Encodes an otpauth URI or JSON input from stdin into the internal format with a generated UID. The output is written to stdout as `KEY=value`.

### Method
CLI Command

### Endpoint
`otplib encode [-b, --bytes <n>] [--save-uid <file>]`

### Parameters
#### Options
- **-b, --bytes <n>** (integer) - Optional - Specifies the byte length for the generated UID.
- **--save-uid <file>** (string) - Optional - Saves the generated UID to the specified file.

### Input
Reads an otpauth URI or JSON from stdin.

### Output
Writes `KEY=value` to stdout, where `KEY` is the generated UID and `value` is the Base64-encoded JSON payload.

### Example
```bash
cat otp-uri.txt | otplib encode
# Output: A1B2C3D4=eyJkYXRhIjp7...}}
```
```

```APIDOC
## otplib list

### Description
Lists all entries from the JSON secrets object read from stdin. Supports fuzzy filtering by ID or label.

### Method
CLI Command

### Endpoint
`otplib list [-f, --filter <query>]`

### Parameters
#### Options
- **-f, --filter <query>** (string) - Optional - Fuzzy filter to apply by ID or label.

### Input
Reads the JSON secrets object from stdin.

### Output
Writes a tab-separated list of entries to stdout, with columns: label, ID, and type.

### Example
```bash
cat storage.json | otplib list
# Output: Service	A1B2C3D4	totp
```
```

```APIDOC
## otplib token

### Description
Generates an OTP token for the specified entry ID. Auto-detects whether the entry is TOTP or HOTP.

### Method
CLI Command

### Endpoint
`otplib token [-n] <id>`

### Parameters
#### Arguments
- **<id>** (string) - Required - The unique identifier of the entry.

#### Options
- **-n** - Optional - Suppresses the trailing newline in the output.

### Input
Reads the JSON secrets object from stdin.

### Output
Writes the generated OTP token to stdout.

### Example
```bash
cat storage.json | otplib token A1B2C3D4
# Output: 123456
```
```

```APIDOC
## otplib type

### Description
Outputs the type of the specified entry, either `totp` or `hotp`.

### Method
CLI Command

### Endpoint
`otplib type [-n] <id>`

### Parameters
#### Arguments
- **<id>** (string) - Required - The unique identifier of the entry.

#### Options
- **-n** - Optional - Suppresses the trailing newline in the output.

### Input
Reads the JSON secrets object from stdin.

### Output
Writes the entry type (`totp` or `hotp`) to stdout.

### Example
```bash
cat storage.json | otplib type A1B2C3D4
# Output: totp
```
```

```APIDOC
## otplib hotp update-counter

### Description
Updates the HOTP counter for the specified entry and outputs the updated entry.

### Method
CLI Command

### Endpoint
`otplib hotp update-counter <id> [n]`

### Parameters
#### Arguments
- **<id>** (string) - Required - The unique identifier of the entry.
- **n** (integer) - Optional - The new counter value. If omitted, the counter is incremented by one.

### Input
Reads the JSON secrets object from stdin.

### Output
Writes the updated entry to stdout.

### Example
```bash
cat storage.json | otplib hotp update-counter A1B2C3D4
```
```

```APIDOC
## otplib verify

### Description
Verifies a token against the specified entry. The exit code indicates the result: 0 for valid, 1 for invalid.

### Method
CLI Command

### Endpoint
`otplib verify <id> <token>`

### Parameters
#### Arguments
- **<id>** (string) - Required - The unique identifier of the entry.
- **<token>** (string) - Required - The token to verify.

### Input
Reads the JSON secrets object from stdin.

### Output
No standard output. The exit code is 0 if the token is valid, 1 if invalid.

### Example
```bash
cat storage.json | otplib verify A1B2C3D4 123456 && echo "valid" || echo "invalid"
```
```

```APIDOC
## otplib guard show

### Description
Shows the current guardrail configuration.

### Method
CLI Command

### Endpoint
`otplib guard show`

### Input
Reads the JSON secrets object from stdin.

### Output
Writes the guardrail configuration to stdout.

### Example
```bash
cat storage.json | otplib guard show
```
```

--------------------------------

### Browser: Use @otplib/plugin-crypto-web

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/runtime-compatibility.md

Recommended setup for browsers using the native Web Crypto API. Requires a secure context (HTTPS); token generation fails on non-secure origins.

```typescript
import { generate, verify, generateSecret } from "otplib";
import { crypto } from "@otplib/plugin-crypto-web";
import { base32 } from "@otplib/plugin-base32-scure";

const secret = generateSecret({ crypto, base32 });
const token = await generate({ secret, crypto, base32 });
```

--------------------------------

### Serve Built Site

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/README.md

Serves the production build locally. Run `pnpm serve` from the apps/docs directory or `pnpm docs:serve` from the project root.

```bash
# Serve production build locally
pnpm serve

# Or from root
pnpm docs:serve
```

--------------------------------

### otplibx CLI usage

Source: https://github.com/yeojz/otplib/blob/main/packages/otplib-cli/README.md

Shows the main otplibx commands: init, add, token, list, and interactive selection with fzf. The init command creates .env.otplibx and .env.keys; the key is checked in OTPLIBX_ENCRYPTION_KEY before .env.keys. Never commit these files.

```bash
# Initialize secrets file
otplibx init

# `otplibx init` creates .env.otplibx (encrypted secrets) and .env.keys
# (the 256-bit key). On POSIX systems both are written with 0600
# permissions; on Windows the bits are not applied, so the files rely on
# the NTFS ACLs of their directory. The key is always written to
# .env.keys — to avoid leaving it on disk (e.g. in CI), copy the value
# into OTPLIBX_ENCRYPTION_KEY and delete the file; commands that load the
# key check the environment variable before .env.keys. Never commit
# either file to version control — add both to .gitignore.

# Add entry from file or clipboard
cat otp-uri.txt | otplibx add
pbpaste | otplibx add

# Generate token
otplibx token A1B2C3D4

# List entries
otplibx list
otplibx list --filter github

# Interactive selection with fzf
npx otplibx token -n "$(npx otplibx list | fzf | cut -f2)" | pbcopy
# OR
npx otplibx list | fzf | cut -f2 | xargs -I {} npx otplibx token -n {} | pbcopy
```

--------------------------------

### Build for Production

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/README.md

Builds the documentation site for production. Run `pnpm build` from the apps/docs directory or `pnpm docs:build` from the project root. The output will be in the `.vitepress/dist/` directory.

```bash
# Build for production
pnpm build

# Or from root
pnpm docs:build
```

--------------------------------

### Get current time step with getTimeStepUsed

Source: https://github.com/yeojz/otplib/blob/main/packages/totp/README.md

Gets the current TOTP counter (time step) value. All parameters are optional.

```typescript
import { getTimeStepUsed } from "@otplib/totp";

const counter = getTimeStepUsed(); // uses current time, period=30, t0=0
const counter2 = getTimeStepUsed(epoch, 30); // explicit time and period
```

--------------------------------

### Get remaining time with getRemainingTime

Source: https://github.com/yeojz/otplib/blob/main/packages/totp/README.md

Gets remaining seconds until the next TOTP period. All parameters are optional and default to the current time with a 30-second period.

```typescript
import { getRemainingTime } from "@otplib/totp";

const seconds = getRemainingTime(); // uses current time, period=30, t0=0
const seconds2 = getRemainingTime(epoch, 30); // explicit time and period
```

--------------------------------

### CLI usage examples

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/cli.md

Shows common CLI usage: listing entries, generating a token, verifying a token, and encoding new entries from a file or clipboard. The verify command exits with 0 for valid and 1 for invalid tokens.

```bash
# Read JSON input from a file
cat storage.json | otplib list
# Output: Service	A1B2C3D4	totp

# Generate a token
cat storage.json | otplib token A1B2C3D4
# Output: 123456

# Verify a token
cat storage.json | otplib verify A1B2C3D4 123456 && echo "valid" || echo "invalid"

# Encode a new entry from file (outputs KEY=value)
cat otp-uri.txt | otplib encode
# Output: A1B2C3D4=eyJkYXRhIjp7...}}

# Encode with custom byte length for longer UIDs
cat otp-uri.txt | otplib encode --bytes 8
# Output: A1B2C3D4E5F6G7H8=eyJkYXRhIjp7...}}

# Encode from clipboard and save the generated UID
pbpaste | otplib encode --save-uid uids.txt
```

--------------------------------

### Generate with proper secret length (SecretTooShortError)

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/troubleshooting.md

Shows a failing example with a 3-byte secret and correct examples using a 20-byte Uint8Array or generateSecret(). The default minimum is 16 bytes (128 bits).

```typescript
// This will fail - secret is too short
const result = await generate({
  secret: new Uint8Array([1, 2, 3]), // Only 3 bytes!
  counter: 0,
  crypto,
});

// Use proper secret length
const result = await generate({
  secret: new Uint8Array(20).fill(0), // 20 bytes minimum
  counter: 0,
  crypto,
});

// Or generate a proper secret
import { generateSecret } from "otplib";
const secret = generateSecret(); // 20 bytes by default
```

--------------------------------

### Initialize otplibx secrets file

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/cli.md

Initializes an encrypted secrets file. Creates .env.otplibx and .env.keys with 0600 permissions on POSIX. Use custom filename with init .env.otp.

```bash
npx -p otplib-cli otplibx init
# OR if installed globally
otplibx init

# Use a custom filename
otplibx init .env.otp
```

--------------------------------

### Provide base32 plugin for string secrets (String secrets require a Base32Plugin)

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/troubleshooting.md

Shows a failing example missing the base32 plugin and a correct example that includes it. The base32 plugin is required when using Base32-encoded string secrets.

```typescript
import { base32 } from "@otplib/plugin-base32-scure";

// Wrong - missing base32 plugin
const result = await generate({
  secret: "GEZDGNBVGY3TQOJQGEZDGNBVGY",
  crypto,
});

// Correct
const result = await generate({
  secret: "GEZDGNBVGY3TQOJQGEZDGNBVGY",
  crypto,
  base32,
});
```

--------------------------------

### Run unit and distribution tests with pnpm

Source: https://github.com/yeojz/otplib/blob/main/CONTRIBUTING.md

Commands for running unit tests on source code and distribution tests on built artifacts. Unit tests run with Vitest; distribution tests require building packages first and target Node.js, Bun, and Deno runtimes.

```bash
pnpm test
pnpm test:ci          # with coverage

# Distribution tests (built artifacts)
pnpm build            # Required: build packages first
pnpm test:dist-node   # Node.js distribution tests
pnpm test:dist-bun    # Bun distribution tests (requires Bun)
pnpm test:dist-deno   # Deno distribution tests (requires Deno)
```

--------------------------------

### Run benchmarks and regenerate dataset

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/benchmarks.md

Commands to run all benchmarks and regenerate the dataset shown in the documentation.

```bash
pnpm --filter @repo/benchmarks bench
```

```bash
pnpm --filter @repo/benchmarks docs:benchmarks
```

--------------------------------

### Get remaining time for TOTP token

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/getting-started.md

Uses getRemainingTime from @otplib/totp to get seconds until the current TOTP token expires. The first call uses default parameters; the second shows custom parameters: current time in seconds, period (30s), and t0 (0).

```typescript
import { getRemainingTime } from "@otplib/totp";

// Seconds until current token expires
const remaining = getRemainingTime();
console.log(`Token expires in ${remaining}s`);

// With custom parameters
const remainingCustom = getRemainingTime(
  Math.floor(Date.now() / 1000), // current time
  30, // period in seconds
  0, // t0 (initial Unix time)
);
```

--------------------------------

### Generate QR code for two-factor authentication

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/getting-started.md

Generates a secret and an otpauth:// URI, then converts it to a QR code data URL using the qrcode package (install with npm install qrcode). Returns the secret, QR data URL, and URI for manual entry. The secret should be stored securely.

```typescript
import { generateSecret, generateURI } from "otplib";
import QRCode from "qrcode"; // npm install qrcode

async function setupTwoFactor(userEmail: string) {
  // Generate a new secret
  const secret = generateSecret();

  // Create otpauth:// URI
  const uri = generateURI({
    issuer: "MyApp",
    label: userEmail,
    secret,
  });

  // Generate QR code as data URL
  const qrDataUrl = await QRCode.toDataURL(uri);

  return {
    secret, // Store securely in database
    qrDataUrl, // Send to frontend for display
    uri, // Alternative: manual entry
  };
}
```

--------------------------------

### Using MOTP-style hooks with generate and verify

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/hooks.md

Shows how to use the MOTP-style hooks with otplib's generate and verify functions. Generates a 6-character hex token and verifies it.

```typescript
import { generate, verify } from "otplib";

const motpHooks = {
  encodeToken: motpEncodeToken,
  validateToken: motpValidateToken,
};

// Generate a 6-character hex token
const token = await generate({
  secret,
  digits: 6,
  hooks: motpHooks,
});
// e.g., "a3f1b2"

// Verify
const result = await verify({
  secret,
  token,
  digits: 6,
  hooks: motpHooks,
});
```

--------------------------------

### Serve build with HTTPS for Web Crypto

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/runtime-compatibility.md

Serve the build locally with HTTPS to provide a secure context for the Web Crypto API.

```bash
npx serve -s build --ssl-cert cert.pem --ssl-key key.pem
```

--------------------------------

### Unsafe secret logging example

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/security.md

Shows logging the secret, which exposes it in logs. Avoid logging secrets.

```typescript
// UNSAFE: Exposes secret in logs
console.log("Verifying token for secret:", secret);
```

--------------------------------

### Generate token in edge runtime

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/runtime-compatibility.md

Example for Cloudflare Workers or Vercel Edge Functions using @otplib/plugin-crypto-web and @otplib/plugin-base32-scure.

```typescript
// Cloudflare Workers / Vercel Edge
import { generate } from "otplib";
import { crypto } from "@otplib/plugin-crypto-web";
import { base32 } from "@otplib/plugin-base32-scure";

export default {
  async fetch(request: Request): Promise<Response> {
    const token = await generate({
      secret: "GEZDGNBVGY3TQOJQGEZDGNBVGY",
      crypto,
      base32,
    });
    return new Response(token);
  },
};
```

--------------------------------

### Safer small verification window example

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/security.md

Shows a smaller epochTolerance value (30) that helps prevent replay attacks.

```typescript
// SAFER: Small verification windows prevent replay attacks
const result = await verify({ secret, token, epochTolerance: 30 });
```

--------------------------------

### Using Steam Guard hooks with generate and verify

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/hooks.md

Shows how to use the Steam Guard hooks with otplib's generate and verify functions. Generates a 5-character token and verifies it.

```typescript
import { generate, verify } from "otplib";

const steamHooks = {
  encodeToken: steamEncodeToken,
  validateToken: steamValidateToken,
};

// Generate a Steam Guard-style token (5 characters)
const token = await generate({
  secret,
  digits: 5,
  hooks: steamHooks,
});
// e.g., "V4XBK"

// Verify
const result = await verify({
  secret,
  token,
  digits: 5,
  hooks: steamHooks,
});
```

--------------------------------

### Cloudflare Worker example

Source: https://github.com/yeojz/otplib/blob/main/packages/plugin-crypto-web/README.md

Shows how to use the plugin in a Cloudflare Worker. The fetch handler is async and uses crypto for OTP operations.

```typescript
import { crypto } from "@otplib/plugin-crypto-web";

export default {
  async fetch(request) {
    // Use crypto for OTP operations
  },
};
```

--------------------------------

### Migrate imports to @otplib/preset-v11

Source: https://github.com/yeojz/otplib/wiki/Upgrading-to-v12

Shows the migration path from v11.x to v12 for users who want to keep the same API. Replace the import from 'otplib' with '@otplib/preset-v11' to maintain the v11.x format of options.

```javascript
// instead of
import { authenticator, hotp, totp } from 'otplib';

// update to
import { authenticator, hotp, totp } from '@otplib/preset-v11';
```

--------------------------------

### Match algorithm for verification (SHA-256)

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/troubleshooting.md

Ensure the algorithm used for verification matches the one used for generation. This example uses 'sha256'.

```typescript
// If token was generated with SHA-256
const result = await verify({
  secret,
  token,
  algorithm: "sha256", // Must match generation algorithm
});
```

--------------------------------

### Migrate from v12 to v13 using the main otplib package

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/v12-adapter.md

Shows the v12 API using the authenticator object and the v13 functional API with generateSecret, generate, and verify. The v13 example also demonstrates the OTP class alternative. Note that v13 functions are async and return a result object with a valid property.

```typescript
// v12
import { authenticator } from "otplib";

const secret = authenticator.generateSecret();
const token = authenticator.generate(secret);
const isValid = authenticator.verify({ token, secret });
```

```typescript
// v13 - Using the Functional API (Recommended)
import { generateSecret, generate, verify } from "otplib";

const secret = generateSecret();
const token = await generate({ secret });
const result = await verify({ secret, token });
const isValid = result.valid;

// v13 - Using the OTP class
import { OTP } from "otplib";

const otp = new OTP();
const secret = otp.generateSecret();
const token = await otp.generate({ secret });
const result = await otp.verify({ secret, token });
const isValid = result.valid;
```

--------------------------------

### Accessing classes via instances

Source: https://github.com/yeojz/otplib/wiki/Upgrading-to-v10

Shows how to access the classes before and after the change. After the change, the classes are available via the instances (e.g., otplib.hotp.HOTP).

```javascript
# before
const HOTP = otplib.HOTP
const TOTP = otplib.TOTP
const Authenticator = otplib.Authenticator

# after
const HOTP = otplib.hotp.HOTP
const TOTP = otplib.totp.TOTP
const Authenticator = otplib.authenticator.Authenticator
```

--------------------------------

### Sample storage.json

Source: https://github.com/yeojz/otplib/blob/main/apps/docs/guide/cli.md

Example of a storage.json file containing a Base64-encoded payload for a TOTP entry. This file is used as input for the CLI commands.

```json
{
  "A1B2C3D4": "eyJkYXRhIjp7InR5cGUiOiJ0b3RwIiwic2VjcmV0IjoiSkJTV1kzRFBFSFBLM1BYUCIsImlzc3VlciI6IlNlcnZpY2UiLCJhbGdvcml0aG0iOiJTSEExIiwiZGlnaXRzIjo2LCJwZXJpb2QiOjMwfX0="
}
```
Tokens:
Raw