Configuration

Register dot-totp in your project by adding Dot\Totp\ConfigProvider::class to your configuration aggregator (to config/config.php for example). This registers Dot\Totp\Totp::class, built by Dot\Totp\TotpFactory from the options below.

Then create the file config/autoload/totp.global.php:

return [
    'dot_totp' => [
        'options'      => [
            // Time step in seconds
            'period'    => 30,
            // Number of digits in the TOTP code
            'digits'    => 6,
            // Hashing algorithm used to generate the code
            'algorithm' => 'sha1',
        ],
    ],
];

The values above are the defaults, and each key is read independently, so a file that sets only period keeps the other two. All three are written into the provisioning URI, so an authenticator app configures itself from them when it scans the QR code.

Changing any of the three after users have enrolled invalidates every existing enrolment, because the app on the user's device keeps the values it scanned.

The attempt limit and the resend cooldown that a delivered code needs are not dot_totp options. They are passed in where they are used, from your own application configuration.

The examples throughout this documentation assume Mezzio and Doctrine ORM. Any container and any persistence layer will do - the steps are the same.