Universal OTP System

One secure OTP layer for every product you ship.

Protect logins, registrations, and recoveries with a shared OTP platform — generate, deliver, and verify without rebuilding security for each app.

Open console Explore the platform

Live demo

4 8 1 9 0 3

Verified Expires in 5m 3 attempts

Click the code to generate a new one

Overview

Why this system matters

Identity checks are where trust breaks. Universal OTP System keeps that trust consistent across projects, teams, and channels.

Stop rebuilding OTP every time One platform for login, registration, forgot password, 2FA, and more — instead of a new fragile flow in every app.
Control risk from one place Set OTP length, kind, expiry, and max attempts per project and API key. Change policy without shipping a new app release.
Ship faster with less exposure Developers configure SMTP and keys; admins govern roles, kinds, and uses. Secrets stay hashed. Access stays intentional.

The idea

OTP should be infrastructure — not a side quest.

Every product eventually needs proof of presence: “is this really you?” Most teams invent that proof again and again — different lengths, different email templates, different expiry rules, different bugs. Universal OTP System turns that chaos into a deliberate platform: projects, keys, SMTP, generation, delivery, and verification under one roof.

Your apps call an API. The platform does the careful work — create the code, send it safely, remember the hash, enforce attempts, expire on time.

Process

The living flow

From configuration to inbox to verification — the full OTP path lives in one system.

Configure

Link a project to an API key and SMTP. Choose OTP kind, length, attempts, and expiry minutes.

Generate

Modules create a cryptographically random code matching the configured alphabet and length.

Send

Delivery goes through your SMTP provider — Gmail, Outlook, Zoho, or custom — owned by the developer.

Verify

Incoming codes are checked with hashed storage, attempt ceilings, and expiry windows.

Catalogue

Built for every OTP moment

Seeded OTP uses cover the moments where users prove identity. Admins can extend the list anytime.

Login Registration Forgot Password Change Password Email Verification Phone Number Verification Two-Factor Authentication Account Recovery

OTP kinds

Choose the shape of the secret

OTP kinds decide what the code looks like — digits for SMS-style flows, mixed for stronger entropy, alphabet-only or special symbols when your product needs it.

Numbers Only 481903 Classic numeric codes users type quickly.

Mixed Numbers & Alphabet A7k2Qm Higher entropy without leaving the keyboard.

Alphabet Only HkLmNp Letter-based codes for branded experiences.

Special Symbols A!7#q* Extra character space when policy demands it.

Console

Everything the console unlocks

Universal OTP System is not only an API — it is an operations surface for people who own security.

Projects & members

Organize work by product. Invite developers and support with clear ownership.

API keys

Create keys first, then link them to one or many projects. Copy secrets once. Soft-delete when done.

SMTP providers

Each developer owns encrypted SMTP settings — host, port, SSL, from-name, default provider.

Configure

Wire project + API key + SMTP + OTP kind + length + attempts + expiry into a living policy.

Roles & permissions

Admins shape access. Developers stay focused on delivery. Support stays in its lane.

Modules

Generate, send, and verify live in dedicated modules — clean boundaries, easier evolution.

Access

Two ways of working, one platform

Different people need different doors. The system keeps those doors honest.

Admin

Govern the system

Users, roles, permissions, role assignments
OTP uses and OTP kinds catalogue
Full visibility across projects and platform health

Developer

Ship the OTP path

Projects, members, and API keys
Personal SMTP providers
Configure project OTP policy and integrate APIs

Security posture

Designed so secrets do not linger in the wrong places.

Hashed OTP storage — verification compares hashes, not raw codes sitting in plain sight.
Encrypted SMTP passwords — provider credentials are protected with data protection.
Attempt ceilings — brute-force guesses hit a wall you configure.
Expiry windows — old codes die on schedule, measured in minutes.
Soft deletes — keys, providers, and configs can be retired without erasing history carelessly.
Project-scoped keys — many projects, many links, clear ownership through UserId and membership.

Lifecycle

A day in the life of a code

Follow one OTP from the moment a product asks for trust to the moment trust is confirmed.

App calls send with email, project code, and API key.
Platform resolves config — SMTP, kind, length, attempts, expiry.
Generator invents the code inside the generateotp module.
Sender delivers mail through the developer’s SMTP provider.
User types the code back into your product.
Verifier checks the hash, remaining attempts, and expire time.
Your app continues — login, reset, verify, recover — with confidence.

Integration

API ready for your apps

Send and verify OTPs over simple HTTP endpoints. Your products stay thin; security stays centralized.

POST /api/v1/otp/send
{
  "email": "user@example.com",
  "projectCode": "MYAPP",
  "apiKey": "sk_live_..."
}

Base URL: http://localhost:5289 · Endpoints: /api/v1/otp/send and /api/v1/otp/verify

Outcomes

What you gain by putting OTP in one place

“Fewer one-off OTP bugs scattered across products.”

“Policy changes without redeploying every client.”

“A clear story for auditors: generate, send, verify, expire.”

“Developers move faster because the hard path already exists.”

Universal OTP System

Ready when your next product needs proof.

Configure once. Call the API. Let the platform carry the weight of trust — so your teams can build features instead of reinventing codes.