Adding TOTP/HOTP two-factor authentication (Google Authenticator-style) to an app.
Overview
Google Authenticator-compatible two-factor auth over Web Crypto — runs on Node, edge and browser. Generate secrets, verify codes with drift tolerance and replay protection, build otpauth:// URIs, and issue single-use hashed backup/recovery codes. A tiny speakeasy alternative, verified against the RFC test vectors.
Install
$ npm install @lacspace/otp
Quick example
@lacspace/otpts
await verifyTotp(code, secret)
Returns 0 (valid) | null
Tips
`keyuri()` produces the `otpauth://` URL for a QR code; show it once during enrollment.
`verifyTotp()` accepts a small time window to tolerate clock drift.
Zero-dependency and isomorphic — safe to import on the server, in the browser, on the edge and in React Native. It tree-shakes, so you only ship what you import.
Watch out for
Store the shared secret encrypted (see @lacspace/crypto) and offer backup codes for recovery.
