Skip to content

otplib API Documentation / @otplib/hotp / HOTP

Class: HOTP ​

Defined in: hotp/src/class.ts:46

HOTP class for HMAC-based one-time password generation

Example ​

typescript
import { HOTP } from '@otplib/hotp';
import { NodeCryptoPlugin } from '@otplib/plugin-crypto-node';
import { ScureBase32Plugin } from '@otplib/plugin-base32-scure';

const hotp = new HOTP({
  issuer: 'MyApp',
  label: 'user@example.com',
  counter: 0,
  crypto: new NodeCryptoPlugin(),
  base32: new ScureBase32Plugin(),
});

const secret = hotp.generateSecret();
const token = await hotp.generate(0);
const isValid = await hotp.verify({ token, counter: 0 });

Constructors ​

Constructor ​

new HOTP(options?): HOTP

Defined in: hotp/src/class.ts:50

Parameters ​

options? ​

HOTPOptions = {}

Returns ​

HOTP

Methods ​

generate() ​

generate(counter, options?): Promise<string>

Defined in: hotp/src/class.ts:78

Generate an HOTP code for a specific counter

Parameters ​

counter ​

number

The counter value

options? ​

Partial<HOTPOptions>

Optional overrides

Returns ​

Promise<string>

The HOTP code

Throws ​

If the algorithm is invalid or unsupported by the plugin

Throws ​

If HMAC computation fails in the crypto plugin


generateSecret() ​

generateSecret(): string

Defined in: hotp/src/class.ts:60

Generate a random Base32-encoded secret

Returns ​

string

Base32-encoded secret


toURI() ​

toURI(counter?): string

Defined in: hotp/src/class.ts:150

Generate an otpauth:// URI for QR codes

Parameters ​

counter? ​

number = 0

The counter value

Returns ​

string

The otpauth:// URI

Throws ​

If a non-empty algorithm is not supported


verify() ​

verify(params, options?): Promise<VerifyResult>

Defined in: hotp/src/class.ts:109

Verify an HOTP code

Parameters ​

params ​

Verification parameters

counter ​

number

token ​

string

options? ​

Partial<HOTPOptions & object>

Optional verification options

Returns ​

Promise<VerifyResult>

Verification result with validity and optional delta

Throws ​

If the algorithm is invalid or unsupported by the plugin

Throws ​

If HMAC computation fails in the crypto plugin

Released under the MIT License.