Documentation
¶
Overview ¶
Package otp implements Time-based One-Time Passwords (TOTP) per RFC 6238 using only the Go standard library. It is compatible with Google Authenticator, Authy, 1Password, and any other RFC 6238-compliant authenticator app.
Quick start:
// On account setup — generate a secret and show the provisioning URI as a QR code.
secret, _ := otp.NewSecret()
uri := otp.ProvisioningURI("alice@example.com", "MyApp", secret)
// Render uri as a QR code using any QR library.
// On login — verify the code from the user's authenticator app.
ok, err := otp.Verify(secret, userSuppliedCode)
Index ¶
- Constants
- Variables
- func Generate(secret string) (string, error)
- func GenerateAt(secret string, t time.Time) (string, error)
- func GenerateBackupCodes(n int) ([]string, error)
- func NewSecret() (string, error)
- func ProvisioningURI(account, issuer, secret string) string
- func Verify(secret, code string) (bool, error)
- func VerifyWithOptions(secret, code string, opts VerifyOptions) (bool, error)
- type VerifyOptions
Constants ¶
const ( // DefaultDigits is the standard OTP code length. DefaultDigits = 6 // DefaultPeriod is the standard TOTP time step in seconds. DefaultPeriod = 30 // DefaultSkew is the number of adjacent time steps checked on either side // of the current step to account for clock drift. DefaultSkew = 1 // SecretBytes is the recommended secret length (20 bytes → 160-bit secret). SecretBytes = 20 )
Variables ¶
var ErrInvalidCode = errors.New("otp: invalid code")
ErrInvalidCode is returned when the supplied code does not match.
Functions ¶
func GenerateAt ¶
GenerateAt returns the TOTP code for the given secret at time t, using the default 30-second period and 6-digit output.
func GenerateBackupCodes ¶
GenerateBackupCodes returns n single-use backup codes. Each code is a random 10-character alphanumeric string. Store the SHA-256 hashes of the returned codes (use crypto.HashPassword) and cross them off as they are used.
func NewSecret ¶
NewSecret generates a cryptographically secure, base32-encoded TOTP secret. Store this value (encrypted at rest) per user. Show it to the user during setup via ProvisioningURI.
func ProvisioningURI ¶
ProvisioningURI returns an otpauth:// URI that encodes the TOTP parameters. Most authenticator apps accept this URI as a QR code payload.
uri := otp.ProvisioningURI("alice@example.com", "MyApp", secret)
// Pass uri to a QR code library (e.g. github.com/skip2/go-qrcode).
func Verify ¶
Verify checks whether code is a valid TOTP for secret at the current time, allowing for the default clock drift tolerance (±1 step).
func VerifyWithOptions ¶
func VerifyWithOptions(secret, code string, opts VerifyOptions) (bool, error)
VerifyWithOptions is like Verify but accepts custom parameters.
Types ¶
type VerifyOptions ¶
type VerifyOptions struct {
// Digits is the expected code length (default: 6).
Digits int
// Period is the time step in seconds (default: 30).
Period uint
// Skew is the number of time steps to check on either side of the current
// step (default: 1, meaning ±30 seconds tolerance with a 30-second period).
Skew uint
}
VerifyOptions configures TOTP verification behaviour.
Source Files