otplib API Documentation / otplib / functional / verify

Function: verify()

verify(options): Promise<VerifyResult>

Defined in: packages/otplib/src/functional.ts:336

Verify an OTP code

Verifies a provided OTP code against the expected value based on the strategy.

• 'totp': Time-based OTP (default, Google Authenticator compatible)
• 'hotp': HMAC-based OTP

Uses constant-time comparison to prevent timing attacks.

Parameters

options

OTPVerifyFunctionalOptions

OTP verification options

Returns

Promise<VerifyResult>

Verification result with validity and optional delta

Throws

If the algorithm is invalid or unsupported by the plugin

Throws

If HMAC computation fails in the crypto plugin

Examples

TOTP

import { verify } from 'otplib';

const result = await verify({
  secret: 'JBSWY3DPEHPK3PXP',
  token: '123456',
});
// Returns: { valid: true, delta: 0 }

HOTP

import { verify } from 'otplib';

const result = await verify({
  secret: 'JBSWY3DPEHPK3PXP',
  token: '123456',
  strategy: 'hotp',
  counter: 0,
});

With epochTolerance for TOTP

import { verify, NodeCryptoPlugin } from 'otplib';

const result = await verify({
  secret: 'JBSWY3DPEHPK3PXP',
  token: '123456',
  epochTolerance: 30,
  crypto: new NodeCryptoPlugin(),
});