addicta/otp
Advanced tools
A comprehensive Laravel package for sending and verifying One-Time Passwords (OTP) via SMS using multiple providers including Twilio and Unifonic.
composer require one-studio/otp
The package will be automatically discovered by Laravel. If you're using Laravel 5.5+, no additional configuration is required.
Add the service provider to your config/app.php:
'providers' => [
// ...
Addicta\Otp\OtpServiceProvider::class,
],
Add the facade alias:
'aliases' => [
// ...
'Otp' => Addicta\Otp\Facades\Otp::class,
],
Publish the configuration file:
php artisan vendor:publish --provider="Addicta\Otp\OtpServiceProvider" --tag="otp-config"
Publish the translation files:
php artisan vendor:publish --provider="Addicta\Otp\OtpServiceProvider" --tag="otp-translations"
This will create:
config/otp.php - Configuration filelang/vendor/otp/en/otp.php - English translationslang/vendor/otp/ar/otp.php - Arabic translationsAdd the following environment variables to your .env file:
# Default Channel: 'phone' or 'email' (default: phone)
OTP_DEFAULT_CHANNEL=phone
# OTP Provider for phone channel (twilio or unifonic)
OTP_PROVIDER=twilio
# Twilio Configuration
TWILIO_ACCOUNT_SID=your_twilio_account_sid
TWILIO_AUTH_TOKEN=your_twilio_auth_token
# Twilio Service Type: 'sms' for direct SMS or 'verify' for Twilio Verify API
TWILIO_SERVICE_TYPE=sms
# Required for SMS service type
TWILIO_FROM=your_twilio_phone_number
# Required for Verify service type
TWILIO_VERIFICATION_SID=your_twilio_verification_sid
# Unifonic Configuration (if using Unifonic)
UNIFONIC_APP_SID=your_unifonic_app_sid
UNIFONIC_SENDER_ID=your_unifonic_sender_id
# Email Configuration
OTP_EMAIL_FROM_ADDRESS=noreply@yourapp.com
OTP_EMAIL_FROM_NAME="Your App Name"
OTP_EMAIL_SUBJECT="Your Verification Code"
# OTP Settings
OTP_LENGTH=4
OTP_EXPIRY=5
MAX_ATTEMPTS=3
RESEND_DELAY=60
BLOCK_DURATION=30
# Test Mode Settings
OTP_TEST_MODE=false
OTP_TEST_CODE=8888
The published configuration file (config/otp.php) contains:
return [
// Default channel for OTP delivery: 'phone' or 'email'
'default_channel' => env('OTP_DEFAULT_CHANNEL', 'phone'),
// Default provider for phone OTPs
'default' => env('OTP_PROVIDER', 'twilio'),
// SMS/Phone providers
'providers' => [
'twilio' => [
'driver' => 'twilio',
'account_sid' => env('TWILIO_ACCOUNT_SID'),
'auth_token' => env('TWILIO_AUTH_TOKEN'),
'service_type' => env('TWILIO_SERVICE_TYPE', 'sms'), // 'sms' or 'verify'
'verification_sid' => env('TWILIO_VERIFICATION_SID'), // Required for 'verify' service
'from' => env('TWILIO_FROM'), // Required for 'sms' service
],
'unifonic' => [
'driver' => 'unifonic',
'app_sid' => env('UNIFONIC_APP_SID'),
'sender_id' => env('UNIFONIC_SENDER_ID'),
],
],
// Email provider configuration
'email' => [
'driver' => 'email',
'from_address' => env('OTP_EMAIL_FROM_ADDRESS', env('MAIL_FROM_ADDRESS', 'noreply@example.com')),
'from_name' => env('OTP_EMAIL_FROM_NAME', env('MAIL_FROM_NAME', 'OTP Service')),
'subject' => env('OTP_EMAIL_SUBJECT', 'Your Verification Code'),
],
'otp_length' => env('OTP_LENGTH', 4),
'otp_expiry' => env('OTP_EXPIRY', 5), // minutes
'max_attempts' => env('MAX_ATTEMPTS', 3),
'resend_delay' => env('RESEND_DELAY', 60), // seconds
'block_duration' => env('BLOCK_DURATION', 30), // minutes after max attempts
// Rate limiting configuration
'rate_limit' => [
'enabled' => env('OTP_RATE_LIMIT_ENABLED', true),
'max_requests_per_hour' => env('OTP_MAX_REQUESTS_PER_HOUR', 3), // per phone number or email
'block_duration' => env('OTP_BLOCK_DURATION', 60), // minutes to block after limit exceeded
],
// Test mode configuration
'test_mode' => env('OTP_TEST_MODE', false),
'test_otp' => env('OTP_TEST_CODE', '8888'),
'test_numbers' => [
'+1234567890',
'+9876543210',
// Add more test numbers as needed
],
'test_emails' => [
'test@example.com',
'demo@example.com',
// Add more test emails as needed
],
];
The package supports sending OTPs through two channels: Phone (SMS) and Email. By default, OTPs are sent via phone, but you can easily switch channels.
Set your preferred default channel in .env:
OTP_DEFAULT_CHANNEL=phone # or 'email'
use Addicta\Otp\Facades\Otp;
// Send OTP to phone number (uses default channel: phone)
$result = Otp::generate('+1234567890');
// Or explicitly specify phone channel
$result = Otp::generate('+1234567890', 'phone');
if ($result['success']) {
echo "OTP sent via SMS!";
echo "Channel: " . $result['channel']; // 'phone'
}
use Addicta\Otp\Facades\Otp;
// Send OTP to email address
$result = Otp::generate('user@example.com', 'email');
if ($result['success']) {
echo "OTP sent via email!";
echo "Channel: " . $result['channel']; // 'email'
}
// Verification works the same way for both channels
$phone = '+1234567890';
$verifyResult = Otp::verify($phone, '1234');
// Or for email
$email = 'user@example.com';
$verifyResult = Otp::verify($email, '1234');
if ($verifyResult['success']) {
echo "Verified successfully!";
}
You can let users choose their preferred verification method:
public function sendOtp(Request $request)
{
$recipient = $request->input('recipient'); // phone or email
$channel = $request->input('channel', 'phone'); // default to phone
$result = Otp::generate($recipient, $channel);
return response()->json($result);
}
Phone Channel:
Email Channel:
Publish the email views to customize them:
php artisan vendor:publish --provider="Addicta\Otp\OtpServiceProvider" --tag="otp-views"
This creates:
resources/views/vendor/otp/emails/otp.blade.php - HTML email templateresources/views/vendor/otp/emails/otp-text.blade.php - Plain text templateBoth channels return the same response structure:
[
'success' => true,
'message' => 'OTP sent successfully.',
'remaining_time' => 60,
'type' => 'success',
'channel' => 'email' // or 'phone'
]
The package supports multiple languages with built-in English and Arabic translations. You can customize messages by publishing and editing the translation files.
Available Languages:
en)ar)Setting Application Locale:
In your Laravel application, set the locale in config/app.php:
'locale' => 'ar', // For Arabic
'locale' => 'en', // For English
Or dynamically in your application:
App::setLocale('ar'); // Switch to Arabic
App::setLocale('en'); // Switch to English
Customizing Messages:
After publishing translations, you can customize the messages in:
lang/vendor/otp/en/otp.php - English messageslang/vendor/otp/ar/otp.php - Arabic messagesThe package includes built-in rate limiting to prevent abuse and excessive OTP requests. Rate limiting uses a rolling window approach - tracking requests in the last 60 minutes per phone number with automatic blocking.
Rate limiting can be configured in your .env file:
# Enable/disable rate limiting
OTP_RATE_LIMIT_ENABLED=true
# Maximum requests per phone number per hour
OTP_MAX_REQUESTS_PER_HOUR=3
# Block duration in minutes after limit exceeded
OTP_BLOCK_DURATION=60
When rate limits are exceeded, the service returns:
[
'success' => false,
'message' => 'Rate limit exceeded. Maximum 3 requests per hour allowed. Blocked for 60 minutes.',
'remaining_time' => 3600, // seconds until unblocked
'type' => 'rate_limited'
]
When phone is blocked, the service returns:
[
'success' => false,
'message' => 'Phone number is blocked due to rate limiting. Try again in 45 minutes.',
'remaining_time' => 2700, // seconds remaining
'type' => 'rate_limited'
]
The type field indicates the reason for the response:
success - OTP sent successfullyrate_limited - Rate limit exceeded or phone blockedblocked - Phone blocked due to failed attemptsresend_delay - Resend delay activesend_failed - Failed to send OTPTo disable rate limiting entirely:
OTP_RATE_LIMIT_ENABLED=false
The package includes a built-in test mode for development and testing purposes. This allows you to test OTP functionality without sending actual SMS messages.
Enabling Test Mode:
OTP_TEST_MODE=true
OTP_TEST_CODE=8888
# Rate limiting configuration
OTP_RATE_LIMIT_ENABLED=true
OTP_MAX_REQUESTS_PER_HOUR=3
OTP_BLOCK_DURATION=60
// In config/otp.php
'test_numbers' => [
'+1234567890',
'+9876543210',
'+201120305686', // Your test number
],
Test Mode Behavior:
Test Mode Response Example:
[
'success' => true,
'message' => 'OTP sent successfully.',
'remaining_time' => 60,
'type' => 'success'
]
Use Cases:
use Addicta\Otp\Facades\Otp;
// Generate OTP
$result = Otp::generate('+1234567890');
if ($result['success']) {
echo "OTP sent successfully!";
echo "Expires in: " . $result['expires_in'] . " seconds";
} else {
echo "Failed to send OTP: " . $result['message'];
}
// Verify OTP
$verifyResult = Otp::verify('+1234567890', '1234');
if ($verifyResult['success']) {
echo "OTP verified successfully!";
} else {
echo "Verification failed: " . $verifyResult['message'];
if (isset($verifyResult['remaining_attempts'])) {
echo "Remaining attempts: " . $verifyResult['remaining_attempts'];
}
}
use Addicta\Otp\OtpService;
class AuthController extends Controller
{
protected $otpService;
f
public function __construct(OtpService $otpService)
{
$this->otpService = $otpService;
}
public function sendOtp(Request $request)
{
$phone = $request->input('phone');
$result = $this->otpService->generate($phone);
return response()->json($result);
}
f
public function verifyOtp(Request $request)
{
$phone = $request->input('phone');
$code = $request->input('code');
$result = $this->otpService->verify($phone, $code);
return response()->json($result);
}
}
use Addicta\Otp\OtpManager;
$manager = app(OtpManager::class);
$provider = $manager->driver(); // Gets the default provider
$result = $provider->send('+1234567890', 'Your OTP is: 1234');
When using Twilio Verify service, the package handles OTP generation and verification seamlessly:
use Addicta\Otp\Facades\Otp;
// Configure .env for Verify service
// TWILIO_SERVICE_TYPE=verify
// TWILIO_VERIFICATION_SID=VAxxxxxxxxxxxxx
// Generate and send OTP using Verify API
$result = Otp::generate('+1234567890');
if ($result['success']) {
// OTP sent via Twilio Verify with custom code
echo "Verification code sent!";
echo "User will receive SMS from Twilio Verify service";
} else {
echo "Error: " . $result['message'];
}
// The package handles verification automatically
$verifyResult = Otp::verify('+1234567890', '1234');
if ($verifyResult['success']) {
// OTP verified successfully
// User can proceed with registration/login
echo "Phone number verified!";
} else {
echo "Invalid code: " . $verifyResult['message'];
}
You can easily switch between service types without changing your application code:
For SMS Service:
TWILIO_SERVICE_TYPE=sms
TWILIO_FROM=+1234567890
For Verify Service:
TWILIO_SERVICE_TYPE=verify
TWILIO_VERIFICATION_SID=VAxxxxxxxxxxxxx
Your application code remains the same regardless of which service you use!
generate(string $phone): arrayGenerates and sends an OTP to the specified phone number.
Parameters:
$phone (string): Phone number in international format (e.g., +1234567890)Returns:
[
'success' => bool,
'message' => string,
'expires_in' => int, // seconds
'remaining_time' => int, // if resend delay active
'blocked_until' => Carbon, // if blocked
]
verify(string $phone, string $code): arrayVerifies an OTP code for the specified phone number.
Parameters:
$phone (string): Phone number in international format$code (string): OTP code to verifyReturns:
[
'success' => bool,
'message' => string,
'remaining_attempts' => int, // if verification failed
]
The package returns detailed error messages for various scenarios. All messages are translatable and will be returned in the current application locale:
English Messages:
// Rate limiting
[
'success' => false,
'message' => 'Please wait 45 seconds before requesting a new OTP.',
'remaining_time' => 45
]
// Blocked phone
[
'success' => false,
'message' => 'Too many attempts. Please try again later.',
'blocked_until' => Carbon::now()->addMinutes(30)
]
// Invalid OTP
[
'success' => false,
'message' => 'Invalid OTP.',
'remaining_attempts' => 2
]
// Expired OTP
[
'success' => false,
'message' => 'OTP expired or not found.'
]
Arabic Messages (when locale is set to 'ar'):
// Rate limiting
[
'success' => false,
'message' => 'يرجى الانتظار 45 ثانية قبل طلب رمز تحقق جديد.',
'remaining_time' => 45
]
// Blocked phone
[
'success' => false,
'message' => 'محاولات كثيرة جداً. يرجى المحاولة مرة أخرى لاحقاً.',
'blocked_until' => Carbon::now()->addMinutes(30)
]
// Invalid OTP
[
'success' => false,
'message' => 'رمز التحقق غير صحيح.',
'remaining_attempts' => 2
]
// Expired OTP
[
'success' => false,
'message' => 'انتهت صلاحية رمز التحقق أو لم يتم العثور عليه.'
]
The package includes comprehensive tests. Run them using:
# Run all tests
./vendor/bin/phpunit
# Run specific test suites
./vendor/bin/phpunit --testsuite=Unit
./vendor/bin/phpunit --testsuite=Feature
# Run with coverage
./vendor/bin/phpunit --coverage-html coverage
The package supports two Twilio service types:
smsaccount_sid, auth_token, fromConfiguration Example:
TWILIO_SERVICE_TYPE=sms
TWILIO_ACCOUNT_SID=your_account_sid
TWILIO_AUTH_TOKEN=your_auth_token
TWILIO_FROM=+1234567890
verifyaccount_sid, auth_token, verification_sidConfiguration Example:
TWILIO_SERVICE_TYPE=verify
TWILIO_ACCOUNT_SID=your_account_sid
TWILIO_AUTH_TOKEN=your_auth_token
TWILIO_VERIFICATION_SID=your_verification_sid
Getting Your Verification SID:
Key Differences:
| Feature | SMS Service | Verify Service |
|---|---|---|
| Message Control | Full customization | Template-based |
| Fraud Detection | Manual | Built-in |
| Delivery Optimization | Standard | Carrier-optimized |
| Analytics | Basic | Advanced |
| Compliance | Manual | Automatic |
| Setup Complexity | Simple | Moderate |
| Cost | Lower | Higher |
Choosing the Right Service:
Documentation:
unifonicapp_sid, sender_idThe package includes a built-in email provider for sending OTPs via email.
The email provider uses Laravel's mail system, so ensure you have your mail driver configured in config/mail.php or .env:
MAIL_MAILER=smtp
MAIL_HOST=smtp.mailtrap.io
MAIL_PORT=2525
MAIL_USERNAME=your_username
MAIL_PASSWORD=your_password
MAIL_ENCRYPTION=tls
MAIL_FROM_ADDRESS=noreply@yourapp.com
MAIL_FROM_NAME="${APP_NAME}"
The email includes:
Works with all Laravel mail drivers:
This package is open-sourced software licensed under the MIT license.
git checkout -b feature/amazing-feature)git commit -m 'Add some amazing feature')git push origin feature/amazing-feature)For support, please open an issue on the GitHub repository or contact the maintainer.
success, message, remaining_time, and type fieldsOtpResponseType enum for type-safe response handlingFAQs
Multi-provider OTP package for Laravel
We found that addicta/otp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Threat Research
/Security News
Compromised maintainer accounts pushed malicious @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2, reusing SleepyDuck’s Ethereum-addressed C2 infrastructure.
Security News
Socket has released a free Certified Patch for a critical Rails Active Storage vulnerability, giving developers time to upgrade to a secure Rails version.
Security News
/Threat Research
A malicious Ruby gem runs a credential-stealing worm during installation, poisons AI coding tools, and can wipe files when a stolen GitHub token is revoked.