Skip to main content

Function: verifyTOTP()

verifyTOTP(token, secret, encryptionKey?): Promise<any>

Defined in: src/auth/shared.ts:675

Validates the provided token against the specified TOTP secret(s).

Enforces replay protection: a token that matches at or before the secret's lastTimeStep is rejected, so an intercepted request (proxy, malicious extension, server logs) can't be replayed to authenticate a second time for as long as the code remains within its validity window. The caller is responsible for persisting the returned timeStep back onto the matched secret (via its uid, if supplied) after a successful verification.

Parameters​

token​

string

The OTP token to validate.

secret​

TOTPSecret | TOTPSecret[]

The stored TOTP secret(s) to validate the token against.

encryptionKey?​

string

The 64-character hex encryption key (TOTPConfig.encryption_key) to decrypt each candidate's secret with before verifying, if it was encrypted at rest. Omit if secrets are stored as plaintext (the default).

Returns​

Promise<any>

The otplib verification result (plus the matched secret's uid, if any) if successful, otherwise undefined.