totp(Base32::decode($secret)); $qrCode = GoogleAuthenticator::getQrCodeUrl('totp', 'otpsample@cr', $secret); $keyUri = GoogleAuthenticator::getKeyUri('totp', 'otpsample@cr', $secret); ?> One Time Passwords Example

One Time Passwords Example

Secret is . This is saved with the users credentials.


QR Code for totp:

This QR Code contains the Key URI:

Current totp would be


Because of timedrift, you could technically enter a code before or after it would actually be used. This form uses the checkTotp function. To test this, open this page, wait until the key changes once or twice (not more) on your Google Authenticator, then hit submit. Even though the key is "wrong" because of small time differences, you can still use it.


Output:

checkTotp(Base32::decode($secret), $key)) { echo 'Key correct!'; // Add here something that makes note of this key and will not allow // the use of it, for this user for the next 2 minutes. This way you // prevent a replay attack. Otherwise your OTP is missing one of the // key features it can bring in security to your application! } else { echo 'Wrong key!'; } } else { echo 'Key not the correct size'; } } ?>