one time key stored in auth table