redis-otp-manager

library1.6.1jsnpmunverified

Lightweight, Redis-backed OTP (one-time password) manager for Node.js and NestJS applications. Current stable version 1.6.1. Provides production-oriented OTP engine with Redis TTL storage, atomic Redis verification, HMAC hashing with secret rotation support, and abuse-control policies (rate limiting, cooldown, lockout). Includes lifecycle hooks for observability. Supports both ESM and CommonJS. Differentiators: intent-aware keying for multi-purpose OTPs, optional sliding window rate limiting, replay protection for token links, and first-class NestJS module export. Requires Node >=18 and peer dependencies for NestJS integration.

security

npm install redis-otp-manager

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · REDIS-OTP-MANAGER

redis-otp-manager

securityjavascriptv1.6.1

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

OTPManager

✓ import { OTPManager } from 'redis-otp-manager'

✗ const OTPManager = require('redis-otp-manager').OTPManager

Correct import for ESM or TypeScript. CommonJS users must use destructured require.

RedisAdapter

✓ import { RedisAdapter } from 'redis-otp-manager'

✗ import { RedisAdapter } from 'redis-otp-manager/adapters'

RedisAdapter is exported from the main package, not a subpath.

NestOtpManagerModule

✓ import { NestOtpManagerModule } from 'redis-otp-manager/nest'

✗ import { NestOtpManagerModule } from 'redis-otp-manager'

NestJS module is exported from a subpath 'redis-otp-manager/nest' to keep main bundle lighter.

Shows Redis client initialization, OTPManager construction with HMAC and rate limiting, generation and verification of an OTP.

import { OTPManager, RedisAdapter } from 'redis-otp-manager'; import { createClient } from 'redis'; const redisClient = createClient({ url: process.env.REDIS_URL ?? 'redis://localhost:6379' }); await redisClient.connect(); const otp = new OTPManager({ store: new RedisAdapter(redisClient), ttl: 300, maxAttempts: 3, devMode: false, hashing: { secret: process.env.OTP_HMAC_SECRET ?? 'default-secret', }, rateLimit: { window: 60, max: 3, }, }); const generated = await otp.generate({ type: 'email', identifier: 'user@example.com', intent: 'login', }); console.log('Generated OTP:', generated.otp); const verified = await otp.verify({ type: 'email', identifier: 'user@example.com', intent: 'login', otp: generated.otp, }); console.log('Verified:', verified); await redisClient.quit();

Debug

Known issues

breakingIn v1.6.0, the `store` option was changed from a direct Redis client to require an adapter (RedisAdapter). Passing a raw Redis client will throw an error.

fix

Wrap your Redis client with new RedisAdapter(redisClient).

affects: >=1.6.0

breakingThe `resendCooldown` option was deprecated in favor of `cooldown`. In v1.7.0, `resendCooldown` will be removed.

fix

Use cooldown: { seconds: 60 } instead of resendCooldown: 60.

affects: >=1.6.0

gotchaThe `hashing.secret` must be at least 32 bytes (256 bits). Shorter secrets will be silently padded, weakening security.

fix

Use a secret of 32+ bytes (e.g., crypto.randomBytes(32).toString('hex')).

affects: >=1.0.0

gotchaThe `otpLength` defaults to 6. Changing it after generating OTPs will not affect existing stored OTPs.

fix

Set otpLength at initialization and do not change it later for consistency.

affects: >=1.0.0

deprecatedIn v1.6.0, `resendCooldown` is deprecated. Use `cooldown` instead.

fix

Replace resendCooldown with cooldown: { seconds: value }.

affects: >=1.6.0

Errors

Common errors & fixes

TypeError: Cannot read properties of undefined (reading 'get')

Redis client not connected or store not properly initialized.

fix

Ensure redisClient.connect() is called before creating OTPManager. Verify Redis URL.

Error: [ERR_REQUIRE_ESM]: require() of ES Module

CJS require() on an ESM-only module path.

fix

Use dynamic import() or switch to CommonJS-compatible imports: const { OTPManager } = require('redis-otp-manager');

Error: OTP not found or expired

The OTP was never generated, TTL expired, or identifier/intent mismatched.

fix

Check that generate() was called with the same type, identifier, and intent. Increase ttl if needed.

Error: Rate limit exceeded. Please try again later.

Too many OTP generation requests within the rate limit window.

fix

Increase rateLimit.max or window, or verify your application logic to avoid excessive calls.

Upgrade

Version history

1.6.1latest on npm

Audit

Dependencies

redisrequiredRedis client adapter for OTP storage

@nestjs/commonoptionalNestJS module integration

@nestjs/coreoptionalNestJS module integration

reflect-metadataoptionalNestJS dependency injection metadata

rxjsoptionalNestJS reactive extensions

Agent activity

19 hits · last 30 days

node

OpenAI (training)

Resources

githubssh://git@github.com/prakashu51/otp-generator ↗

packageredis-otp-manager ↗

homepagehttps://github.com/prakashu51/otp-generator#readme ↗