How to Create Your Own One-Time Password (OTP) Service?

I use a link verification system instead of OTPs. Essentially, I generate a unique hash for each user and email them a link containing that hash. When they click on the link, it verifies against what's stored on the server. If they need to resend, it clears the old hash and creates a new one. I can share more details if you're interested, just busy at work right now!

Have you considered using services like AWS Cognito? It could end up being cheaper and save you a ton of development headaches later.

Rolling your own OTP service might not be the best route to take. It's often easier to use established solutions since they handle a lot of the security and reliability aspects for you. But if you really want to learn, it can be a valuable experience!

Honestly, if you're not careful with how you manage your email sending domain, creating an OTP service could lead to more problems than it solves. I'd focus on that aspect first if you pursue this direction.

A solid approach is to only generate the OTP when necessary, like for email or phone verifications. Here's a simple flow: generate a random OTP, store its hashed version alongside the user's identifier and an expiration time (e.g., 5 minutes). Send the plain OTP to the user. When they input it, check if it's valid and not expired by comparing the hashes. Don't forget to invalidate it after using! You could even automate cleanup for expired OTPs using cron jobs or Redis for better efficiency.