OTPGateway
https://github.com/knadh/otpgateway- Category
- Developer Tools
- Rank
- No. 877Tools index
Previous survey · No. 860 ·
- Pricing
- Open Source
- Type
- TOOL
- Builder
- knadh
- GitHub
- 534 stars
- Latest release
- v3.6.4
- Date
About
Standalone server for user address and OTP verification flows with pluggable providers for email, SMS, and bank penny drops.
What it does
An application creates a short-lived challenge through OTPGateway, which stores its state in Redis and asks a configured delivery backend to send the code. Users can finish verification through the included browser interface, while the originating application confirms the result through HTTP.
Why it's ranked here
The case for OTPGateway is its tight, understandable scope. It combines delivery adapters, challenge expiry, attempt and regeneration limits, tenant separation, a ready-made user flow, and a programmable API. Requiring Redis adds operational weight, but the core verification lifecycle remains coherent and inspectable.
What's good
The provider model treats addresses and codes as generic strings, so one flow supports several delivery channels. Bundled SMTP, AWS Pinpoint, Kaleyra SMS, and Kaleyra WhatsApp options cover common cases, while configurable webhooks admit custom upstreams. Templates, optional address collection, custom codes, expiry controls, and attempt limits provide useful integration control.
Tradeoffs
Redis is mandatory, so the downloadable server is not a self-contained deployment. Tenant separation uses namespace and secret Basic Authentication rather than a richer authorization model. The generic webhook provider performs no address validation and treats any completed HTTP response as success, even when the upstream returns an error status. The supplied tests demonstrate Redis behavior, not the complete HTTP and provider surface.
How to use it well
Use it when several applications need one backend-owned flow for sending, collecting, and checking short-lived codes. Generate challenges server side, embed the supplied modal or build against the JSON API, then confirm status from your backend before updating records. Treat successful verification as proof that the user received a code, not as broader identity proofing.
Technical notes+
cmd/otpgateway/main.go builds a chi HTTP server, registers authenticated API routes and public verification views, requires Redis connectivity at startup, and serves packed static assets. cmd/otpgateway/init.go merges TOML files, OTP_GATEWAY_ environment variables, and flags, then initializes bundled or webhook providers. internal/store/redis/redis.go persists OTPs as expiring Redis hashes, uses transactions for counters, and can publish check and close events. pkg/models/models.go defines the Provider and OTP contracts. internal/providers/webhook/webhook.go returns success after any HTTP response without checking its status and accepts every address. static/otp.js embeds the flow in an iframe and validates callback origins with a substring test rather than exact equality. internal/store/redis/redis_test.go tests set, counter, TTL, close, and delete behavior.
Observed
- License
- MIT License
- Primary language
- Go
- Packaging
- Downloadable executable with static assets packed into the binary; configuration uses TOML, environment variables, and flags
- Interfaces
- HTTP/JSON API, built-in web views, and an embeddable JavaScript modal
- Authentication
- Namespace and secret credentials supplied through HTTP Basic Authentication
- Storage
- Redis-backed expiring OTP records with optional PubSub events
- Provider surface
- SMTP, AWS Pinpoint SMS, Kaleyra SMS and WhatsApp, plus configurable JSON webhooks
- Testing structure
- Repository text includes Redis store tests using an in-memory Redis implementation
Read from README.md, go.mod, Makefile, pkg/models/models.go, internal/store/store.go, internal/store/redis/redis.go, internal/providers/smtp/smtp.go, internal/store/redis/redis_test.go, internal/providers/kaleyra/kaleyra.go, internal/providers/webhook/webhook.go, internal/providers/pinpoint/pinpoint.go, static/otp.js, cmd/otpgateway/main.go, cmd/otpgateway/init.go, cmd/otpgateway/handlers.go.
What it can do
Verify user email addresses
Email address and verification request → Email verification status and OTP delivery confirmation
Send SMS OTP for verification
Phone number and verification request → SMS delivery status and OTP code
Perform bank penny drop verification
Bank account details → Account verification status and penny drop confirmation
Validate OTP codes
OTP code and verification session → Verification success or failure status
Generate time-based OTP codes
User identifier and verification request → Unique OTP code with expiration time
Manage verification provider configurations
Provider settings and API credentials → Active provider configuration status
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.