REAL OTP SYSTEM
OTP is now backend generated and secured.
Forgot password OTP now uses random OTP, hashed database storage, expiry time, attempt limit and configurable Email/SMS/WhatsApp provider.
Test Forgot Password
Random OTP
OTP_LENGTH=6Expiry
OTP_EXPIRY_MINUTES=10Attempt Limit
OTP_MAX_ATTEMPTS=5Secure Storage
otp_hash saved, plain OTP hiddenProvider Config
Email OTP
OTP_CHANNEL=email
EMAIL_SMTP_HOST=smtp.example.com
EMAIL_SMTP_USER=your_email
EMAIL_SMTP_PASS=your_password
SMS OTP
OTP_CHANNEL=sms
SMS_API_URL=https://provider-url
SMS_API_KEY=provider_key
WhatsApp OTP
OTP_CHANNEL=whatsapp
WHATSAPP_API_URL=https://provider-url
WHATSAPP_API_KEY=provider_key
Console Test
OTP_CHANNEL=console
npm run otp:test
Backend Routes
POST
/api/auth/forgot-password/request-otpPOST
/api/auth/forgot-password/verify-otpPOST
/api/auth/forgot-password/reset