Using custom provider with OTP capabilities

[EstebanBorai]

Question 💬

I'm working on an application that uses Auth0's OTP authentication, the authentication flow is a 3 step process.

1. The user provides an identifier, either phone or email
2. The user receives a code either via SMS or Email
3. The user redeems the code and logs in if the code is valid and not expired

I'm working on integrating Next Auth with this flow and I'm stepping on providers at the moment, so far I see that
most of the providers are OAuth based and that there's an email provider that handles magic link.

Is possible to implement a provider for my current flow?

How to reproduce ☕️

This is a question.

Contributing 🙌🏽

Yes, I am willing to help answer this question in a PR

[balazsorban44]

Currently, we support only email as an identifier built-in. Are you asking if we could support phone/SMS as well? I have seen people doing it in old issues by customizing the Email provider https://next-auth.js.org/providers/email

There is also the RFC #1465 to generalize the Email provider, but nothing has been done yet.

[kam-st]

How about if otp can be send via email. Instead of clicking link, user can enter otp sent to email. A lot of passwordless systems have this functionality.

[Husain010]

How about if otp can be send via email. Instead of clicking link, user can enter otp sent to email. A lot of passwordless systems have this functionality.

Is there a way to do this?

[EstebanBorai]

I think today you could use Credentials provider but in the back-end rely on the OTP provider.

The Credentials provider allows you to setup custom fields, so you can adapt it to OTP needs in the authenticate method.

[Husain010]

Any demo code or example available?

[captainR0bbo]

@ramiel documented how to do OTP here. https://www.ramielcreations.com/nexth-auth-magic-code

I was thinking I might take his work and submit a PR to the auth.js docs as it’s not easy to figure out how to piece it all together to make it work the way ramiel did.