One-time password (OTP)
A short code meant to work once, delivered by email or SMS or generated by an authenticator app.
What it is
A one-time password is a code intended to work once, usually for a short window. Some are random challenges generated by a server and delivered over email or SMS. HOTP and TOTP generate codes from a shared secret instead, with TOTP producing the six digits that rotate every 30 seconds in Google Authenticator or 1Password.
Reach for an OTP when a person needs to prove possession of an inbox, phone number, or enrolled authenticator without typing a long secret. It can power passwordless login, email verification, transaction confirmation, or a second factor. The delivery channel determines what the proof is worth: an emailed code proves inbox access, not identity.
The gotcha is that short numeric codes are easy to guess and easy to phish. Give them a tight expiry, one successful use, a small attempt budget, and rate limits on both sending and checking. A new code should invalidate the old one, and logs and analytics must never record the plaintext code.
Ask AI for it
Build a six-digit email OTP login flow using Node.js `crypto.randomInt(0, 1000000)` and the Resend Emails API. Left-pad the code to six digits, store only an HMAC-SHA-256 digest made with a server-held pepper plus the user ID and challenge ID, and expire it after 10 minutes. Invalidate earlier challenges when sending a new code, allow at most five verification attempts, rate limit sends by account and IP, and consume a successful challenge atomically before creating the session. Return the same response whether an email is registered or not, never log the code, and make pasted codes work with or without spaces.