v1.0.0

2fa-node v1.0.0

Fixes

• HOTP now follows RFC 4226, so its tokens match authenticator apps (0.x HOTP tokens never did).
• Empty or invalid secrets are rejected; 0.x accepted a token anyone could compute for them.
• Generated secrets use every bit of each byte (0.x lost one bit per byte).
• The library no longer changes otplib's global settings for the whole process.

New

• verifyTokenOnce accepts each TOTP token only once (replay protection).
• SecretOptions and OtpType types are exported.
• Upgraded to otplib 13 (otplib 12 is deprecated).

Breaking changes

• HOTP tokens differ from 0.x.
• verifyToken and verifyHOTPToken return only true or false (no more null).
• verifyToken accepts 1 step (±30 s) by default instead of 4.
• verifyHOTPToken requires counter and drops the window argument, which never worked.
• numberOfSecretBytes must be at least 16; invalid types, counters and windows throw.
• Secrets must be canonical base32 of at least 80 bits.
• The otpauth URI uses the standard issuer parameter instead of name.
• Only the package entry point can be imported, and Node.js 20.19+ is required.
• License changed from MIT to MPL-2.0.