Passwordless OTP Login in Laravel with Fast2SMS (Complete Flow, With Tests)

composer require itxshakil/laravel-fast2sms
php artisan vendor:publish --tag=fast2sms-config

FAST2SMS_API_KEY=your_api_key_here
FAST2SMS_DRIVER=log

php artisan make:migration add_phone_to_users_table

public function up(): void
{
    Schema::table('users', function (Blueprint $table) {
        $table->string('phone', 10)->unique()->nullable()->after('email');
        $table->string('password')->nullable()->change();
    });
}

<?php

namespace App\Services;

use Illuminate\Support\Facades\Cache;
use Illuminate\Support\Facades\Hash;
use Shakil\Fast2sms\Facades\Fast2sms;

class OtpService
{
    private const TTL_SECONDS = 300;      // code lives for 5 minutes
    private const MAX_ATTEMPTS = 5;       // wrong guesses before the code is invalidated
    private const RESEND_COOLDOWN = 60;   // seconds between sends to the same number

    public function send(string $phone): void
    {
        if (Cache::has($this->cooldownKey($phone))) {
            return; // silently ignore rapid resends; the first code is still valid
        }

        $code = (string) random_int(100000, 999999);

        Cache::put($this->codeKey($phone), Hash::make($code), self::TTL_SECONDS);
        Cache::put($this->attemptsKey($phone), 0, self::TTL_SECONDS);
        Cache::put($this->cooldownKey($phone), true, self::RESEND_COOLDOWN);

        Fast2sms::otp(numbers: $phone, otpValue: $code);
    }

    public function verify(string $phone, string $code): bool
    {
        $hash = Cache::get($this->codeKey($phone));

        if ($hash === null) {
            return false; // expired or never sent
        }

        $attempts = Cache::increment($this->attemptsKey($phone));

        if ($attempts > self::MAX_ATTEMPTS) {
            $this->forget($phone);

            return false;
        }

        if (! Hash::check($code, $hash)) {
            return false;
        }

        $this->forget($phone);

        return true;
    }

    private function forget(string $phone): void
    {
        Cache::forget($this->codeKey($phone));
        Cache::forget($this->attemptsKey($phone));
    }

    private function codeKey(string $phone): string
    {
        return "otp:code:{$phone}";
    }

    private function attemptsKey(string $phone): string
    {
        return "otp:attempts:{$phone}";
    }

    private function cooldownKey(string $phone): string
    {
        return "otp:cooldown:{$phone}";
    }
}

php artisan make:request SendOtpRequest
php artisan make:request VerifyOtpRequest

// app/Http/Requests/SendOtpRequest.php
use Shakil\Fast2sms\Rules\Fast2smsPhone;

public function rules(): array
{
    return [
        'phone' => ['required', 'string', new Fast2smsPhone],
    ];
}

// app/Http/Requests/VerifyOtpRequest.php
use Shakil\Fast2sms\Rules\Fast2smsPhone;

public function rules(): array
{
    return [
        'phone' => ['required', 'string', new Fast2smsPhone],
        'code' => ['required', 'digits:6'],
    ];
}

<?php

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use App\Http\Requests\SendOtpRequest;
use App\Http\Requests\VerifyOtpRequest;
use App\Models\User;
use App\Services\OtpService;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\View\View;

class OtpLoginController extends Controller
{
    public function __construct(private readonly OtpService $otp) {}

    public function showPhoneForm(): View
    {
        return view('auth.otp.phone');
    }

    public function sendCode(SendOtpRequest $request): RedirectResponse
    {
        $phone = $request->validated('phone');

        $this->otp->send($phone);

        $request->session()->put('otp_phone', $phone);

        return redirect()->route('otp.verify.form')
            ->with('status', 'We sent a 6-digit code to your number.');
    }

    public function showVerifyForm(Request $request): View|RedirectResponse
    {
        if (! $request->session()->has('otp_phone')) {
            return redirect()->route('otp.phone.form');
        }

        return view('auth.otp.verify', ['phone' => $request->session()->get('otp_phone')]);
    }

    public function verifyCode(VerifyOtpRequest $request): RedirectResponse
    {
        $phone = $request->validated('phone');

        if (! $this->otp->verify($phone, $request->validated('code'))) {
            return back()->withErrors(['code' => 'That code is wrong or has expired.']);
        }

        $user = User::firstOrCreate(['phone' => $phone], ['name' => $phone]);

        Auth::login($user);

        $request->session()->regenerate();
        $request->session()->forget('otp_phone');

        return redirect()->intended('/dashboard');
    }
}

// app/Providers/AppServiceProvider.php
use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\RateLimiter;

public function boot(): void
{
    RateLimiter::for('otp-send', fn (Request $request) => [
        Limit::perMinute(3)->by((string) $request->input('phone')),
        Limit::perMinute(10)->by($request->ip()),
    ]);

    RateLimiter::for('otp-verify', fn (Request $request) => [
        Limit::perMinute(10)->by((string) $request->input('phone')),
    ]);
}

// routes/web.php
use App\Http\Controllers\Auth\OtpLoginController;

Route::middleware('guest')->group(function () {
    Route::get('/login', [OtpLoginController::class, 'showPhoneForm'])->name('otp.phone.form');
    Route::post('/login/send', [OtpLoginController::class, 'sendCode'])
        ->middleware('throttle:otp-send')
        ->name('otp.send');
    Route::get('/login/verify', [OtpLoginController::class, 'showVerifyForm'])->name('otp.verify.form');
    Route::post('/login/verify', [OtpLoginController::class, 'verifyCode'])
        ->middleware('throttle:otp-verify')
        ->name('otp.verify');
});

{{-- resources/views/auth/otp/phone.blade.php --}}
<form method="POST" action="{{ route('otp.send') }}">
    @csrf
    <label>Mobile number</label>
    <input name="phone" inputmode="numeric" maxlength="10" value="{{ old('phone') }}" required>
    @error('phone') <p>{{ $message }}</p> @enderror
    <button type="submit">Send code</button>
</form>

{{-- resources/views/auth/otp/verify.blade.php --}}
@if (session('status')) <p>{{ session('status') }}</p> @endif

<form method="POST" action="{{ route('otp.verify') }}">
    @csrf
    <input type="hidden" name="phone" value="{{ $phone }}">
    <label>Enter the 6-digit code</label>
    <input name="code" inputmode="numeric" autocomplete="one-time-code" maxlength="6" required>
    @error('code') <p>{{ $message }}</p> @enderror
    <button type="submit">Log in</button>
</form>

<form method="POST" action="{{ route('otp.send') }}">
    @csrf
    <input type="hidden" name="phone" value="{{ $phone }}">
    <button type="submit">Resend code</button>
</form>

tail -f storage/logs/laravel.log | grep -i otp

<?php

namespace Tests\Feature\Auth;

use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Shakil\Fast2sms\Enums\SmsRoute;
use Shakil\Fast2sms\Facades\Fast2sms;
use Tests\TestCase;

class OtpLoginTest extends TestCase
{
    use RefreshDatabase;

    public function test_user_can_log_in_with_a_valid_code(): void
    {
        Fast2sms::fake();

        $this->post(route('otp.send'), ['phone' => '9876543210'])
            ->assertRedirect(route('otp.verify.form'));

        Fast2sms::assertSmsSentTo('9876543210');
        Fast2sms::assertSmsSentWithRoute(SmsRoute::OTP);

        // The OTP route sends the code as the template variable.
        $code = Fast2sms::sentSms()[0]->parameters->variablesValues;

        $this->post(route('otp.verify'), ['phone' => '9876543210', 'code' => $code])
            ->assertRedirect('/dashboard');

        $this->assertAuthenticated();
        $this->assertDatabaseHas('users', ['phone' => '9876543210']);
    }

    public function test_wrong_code_is_rejected(): void
    {
        Fast2sms::fake();

        $this->post(route('otp.send'), ['phone' => '9876543210']);

        $this->post(route('otp.verify'), ['phone' => '9876543210', 'code' => '000000'])
            ->assertSessionHasErrors('code');

        $this->assertGuest();
    }

    public function test_invalid_phone_never_sends(): void
    {
        Fast2sms::fake();

        $this->post(route('otp.send'), ['phone' => '12345'])
            ->assertSessionHasErrors('phone');

        Fast2sms::assertNothingSent();
    }

    public function test_resend_inside_cooldown_does_not_send_again(): void
    {
        Fast2sms::fake();

        $this->post(route('otp.send'), ['phone' => '9876543210']);
        $this->post(route('otp.send'), ['phone' => '9876543210']);

        Fast2sms::assertSmsSentCount(1);
    }
}

FAST2SMS_DRIVER=api
FAST2SMS_QUEUE_ENABLED=true
FAST2SMS_DEDUP_ENABLED=true
FAST2SMS_DEDUP_TTL=60
FAST2SMS_BALANCE_GATE=true
FAST2SMS_BALANCE_THRESHOLD=100