PHPackages 3neti/form-handler-otp - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. 3neti/form-handler-otp ActiveLibrary[Authentication & Authorization](/categories/authentication) 3neti/form-handler-otp ====================== OTP verification handler for form flow system v1.1.0(2w ago)01.1k1MITPHPPHP ^8.2CI passing Since Dec 24Pushed 2w agoCompare [ Source](https://github.com/3neti/form-handler-otp)[ Packagist](https://packagist.org/packages/3neti/form-handler-otp)[ RSS](/packages/3neti-form-handler-otp/feed)WikiDiscussions main Synced 2w ago READMEChangelogDependencies (15)Versions (3)Used By (1) OTP Handler =========== [](#otp-handler) `3neti/form-handler-otp` adds mobile one-time-password verification to `3neti/form-flow`. It delegates OTP generation, delivery, expiry, attempt tracking, and verification to a configured Txtcmdr service. Requirements ------------ [](#requirements) - PHP 8.2 or newer - Laravel 12 or 13 - Form Flow 1.8 or newer - Inertia Laravel 2 or 3 in applications that render the published Vue page Installation ------------ [](#installation) ``` composer require 3neti/form-handler-otp php artisan otp-handler:install --no-interaction ``` The package service provider registers the `otp` handler automatically. The install command publishes the package configuration and Vue page. Configuration ------------- [](#configuration) Publish the configuration independently when needed: ``` php artisan vendor:publish --tag=otp-handler-config ``` Configure the Txtcmdr endpoint and bearer token in the host environment: ``` TXTCMDR_API_URL=https://txtcmdr.example TXTCMDR_API_TOKEN= TXTCMDR_TIMEOUT=30 OTP_MAX_RESENDS=3 OTP_RESEND_COOLDOWN=30 ``` Do not commit the API token. The handler sends it only as the bearer token for Txtcmdr requests. Form Flow contract ------------------ [](#form-flow-contract) Add an `otp` step after a step that collects `mobile`: ``` [ 'handler' => 'otp', 'config' => [ 'max_resends' => 3, 'resend_cooldown' => 30, 'digits' => 6, 'ui_variant' => 'compact', ], ] ``` The handler reads the mobile number from the current Form Flow session. It fails before contacting Txtcmdr if no mobile number has been collected. On the first render, the handler: 1. requests an OTP from `POST /api/otp/request`; 2. stores only the returned verification identifier in the session; 3. renders the OTP capture page. On submission, it verifies the code through `POST /api/otp/verify`. A successful verification clears the verification and delivery-control session state, then returns: ``` [ 'mobile' => '639171234567', 'otp_code' => '123456', 'verified_at' => '2026-07-31T15:00:00+08:00', 'reference_id' => 'flow-123', ] ``` The returned code is Form Flow result data. Hosts should apply their own data retention and redaction policy before persisting or logging collected results. User interface -------------- [](#user-interface) The published Vue page supports Form Flow's `default`, `compact`, and `immersive` UI variants. It uses the shared Form Flow screen and action components, accepts numeric input, submits the nested `data.otp_code` payload, and focuses the code input on entry. Delivery safeguards ------------------- [](#delivery-safeguards) - Verification identifiers are isolated by Form Flow reference in the session. - Successful codes are one-time because Txtcmdr is the verification authority and local session state is cleared after acceptance. - Resend count and cooldown are enforced by the server handler, not only by the browser. - Provider rejection reasons are mapped to sanitized validation messages. - A missing verification session or mobile number fails closed. - Hosts should still rate-limit Form Flow endpoints by authenticated principal, session, mobile reference, and source address. Testing ------- [](#testing) ``` composer test composer pint -- --test composer audit ``` The package suite fakes HTTP and verifies the request, session, resend, provider-rejection, expiry, and UI render contracts without sending SMS. License ------- [](#license) MIT ### Health Score 45 — FairBetter than 91% of packages Maintenance96 Actively maintained with recent releases Popularity16 Limited adoption so far Community8 Small or concentrated contributor base Maturity49 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~219 days Total 2 Last Release 18d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/586e1ed70140038e6348728222adbcf68bfc4455b1f94a4f8bcbe57917a63d57?d=identicon)[3neti](/maintainers/3neti) --- Top Contributors [![3neti](https://avatars.githubusercontent.com/u/89447696?v=4)](https://github.com/3neti "3neti (5 commits)") ### Code Quality TestsPest Code StyleLaravel Pint ### Embed Badge ![Health badge](/badges/3neti-form-handler-otp/health.svg) ``` [![Health](https://phpackages.com/badges/3neti-form-handler-otp/health.svg)](https://phpackages.com/packages/3neti-form-handler-otp) ``` ### Alternatives [illuminate/auth The Illuminate Auth package. 9328.5M1.4k](/packages/illuminate-auth) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)