oauthpasswordsone-time-passwordmulti-factor-authentication

Using One Time Password as main authentication

I need to implement the equivalent of One Time password, meaning that I need the flow:

  1. User enter contact address (phone number, email ....)
  2. The server generates a short password, send it to the user through mail/sms/pidgin
  3. User read the message, and copy past the code in the app.
  4. Server authorize credential and approve login (create a session/return token to the user)

I do not want to the user to type/update/reset any other password, once the one time password has been entered, he is logged in.

I am looking at OTP for this, but all I can find for OTP is to be used as MFA in combination of the user actual password.

Is there a name for such login flow? Any literature about it?

Thank you

Solution

  • Such a flow is usually called a "magic link".

    https://auth0.com/docs/connections/passwordless/guides/email-magic-link https://magic.link/docs/home/welcome