One-time-code factor

Copy Markdown View Source

one_time_code is the built-in development/test factor provider.

It generates a high-entropy one-time code and returns that code in the session challenge response.

Why this is not production MFA

If the same remote caller receives the challenge and the code, the code is not an independent second factor. It only proves the caller can read the KMS API response.

Use one_time_code for:

  • local development;
  • tests;
  • demos;
  • building a custom provider prototype.

Do not use one_time_code as production MFA for remote users.

Challenge shape

A pending session challenge includes the code:

%{
  provider: "one_time_code",
  factor_id: "...",
  label: "email",
  code: "..."
}

The caller advances with that code:

{:ok, session} = KMS.advance_session(pending.secret, %{code: challenge.code})

Production alternatives

Use one of:

  • totp for authenticator-app MFA;
  • a custom provider that sends codes out of band by email, SMS, push, or another trusted channel;
  • WebAuthn/passkeys outside KMS when phishing-resistant MFA is required.

Custom production providers should return challenge metadata only and must not return secret codes in API responses.