Authentication with Laravel OTP
Tags: laravel, otp, php, authentication
Published: 2022-03-01 12:29:10

---
title: Authentication with Laravel OTP
published: true
description: Nowadays most web applications prefer to use OTP(One-Time Password) instead of using username/password which was a classic authentication system to validate users. Because, this way is secure more and in contrast to static passwords, they are not vulnerable to replay attacks.
tags: Laravel,OTP,PHP,Authentication
cover_image: https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m9jcprttcwudvgip8z1f.jpeg
---
Nowadays most web applications prefer to use **OTP**(One-Time Password) instead of using username/password which was a classic authentication system to validate users. Because, this way is more secure and in contrast to static passwords, they are not vulnerable to replay attacks.

Maybe you are also worried about implementing a one-time password as a web developer in the **Laravel** framework.

There are many concerns about that such as :
- How can I generate a secure token?
- Where should I store generated token?
- Is token valid or not? Is token expired or not?
- How can I have an integrated and also usable system for different user providers?
- etc…

Well, good news! We have just released a package to resolve your concerns. Here you are. This is Laravel OTP package.

Let’s start a practical implementation step by step.

#Getting started

First, you should install OTP package via composer:
```
composer require fouladgar/laravel-otp
```
Then, publish `config/otp.php` file by running:
```
php artisan vendor:publish --provider="Fouladgar\OTP\ServiceProvider" --tag="config"
```
And Finally migrate the database:

```sh
php artisan migrate
```

#Model Preparation

As next step, make sure the user model implement `Fouladgar\OTP\Contracts\OTPNotifiable`, and also use `Fouladgar\OTP\Concerns\HasOTPNotify` trait:
{% gist https://gist.github.com/mohammad-fouladgar/802830fcde11e557b91ce0cf8eb8b78f %}

#SMS Client

There is a default `OTPSMSChannel` which needs a SMS client for sending generated token to the user mobile phone. So, you should specify your SMS client and implement `Fouladgar\OTP\Contracts\SMSClient` contract. This contract requires you to implement `sendMessage` method.

This method will return your SMS service API results via a `Fouladgar\OTP\Notifications\Messages\MessagePayload` object which contains user **mobile** and **token** message:
{% gist https://gist.github.com/mohammad-fouladgar/43539893a02ab26eda59501e08f3af42 %}

Next, you should set the client wrapper `SampleSMSClient` class in `config/otp.php` file:
{% gist https://gist.github.com/mohammad-fouladgar/aec20546fa81e33707ffc9a7908de415 %}
It’s almost over…

#Setup Routes and Controller
We need some routes to **send** and **validate** the token. Let’s make them and implement our controller.

You may add those in the `web` or `api` routes. It depends on you want to use OTP as **Full Stack** or **API Back-End**. It’s up to you. In this article I prefer use the second way.

Well, open the `routes/api.php` and put this routes:
{% gist https://gist.github.com/mohammad-fouladgar/ef375de0cbacad659e542b50c31f0f80 %}

And then create a AuthController.php class like this:
{% gist https://gist.github.com/mohammad-fouladgar/a02af640d155acacea1f66b7d9ac62e1 %}
Finish. Now, you can call the routes like below:
```
// send otp request
curl --request POST \
  --url http://localhost/api/send-otp \
  --data '{
 "mobile" : "09389599530"
}'

// validate otp request
curl --request POST \
  --url http://localhost:8585/api/validate-otp \
  --data '{
 "mobile" : "09389599530",
 "token" : "94352"
}'
```
That’s it.

For more details, please check out the documentation in GitHub:

{% github https://github.com/mohammad-fouladgar/laravel-otp %}

Hope to useful this package. I’m waiting your opinions and comments.

Thank you for sharing your valuable time with me.