# ethotp

> Node.js implementation of Ethereum One-Time Password (EthOTP) Authentication

Latest version **1.0.1** (published 2019-08-03) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install ethotp
pnpm add ethotp
yarn add ethotp
bun add ethotp
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.0.1 |
| Published | 2019-08-03 |
| First published | 2019-08-03 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 1 |
| Unpacked size | 22.5 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 1 |
| Author | feng |
| Maintainers | feng9 |
| Keywords | ethereum, web3, js, authentication |

## Links

- npm: https://www.npmjs.com/package/ethotp
- Repository: https://github.com/insightsan/EthOTP
- Homepage: https://github.com/insightsan/EthOTP#readme
- Issues: https://github.com/insightsan/EthOTP/issues
- npm.io page: https://npm.io/package/ethotp

## Dependencies (1)

- [eth-crypto](https://npm.io/package/eth-crypto.md) ^1.3.4

## Alternatives

- [@mapbox/jsonlint-lines-primitives](https://npm.io/package/@mapbox/jsonlint-lines-primitives.md) — 5.3M weekly downloads
- [reftools](https://npm.io/package/reftools.md) — 3.5M weekly downloads
- [@hey-api/openapi-ts](https://npm.io/package/@hey-api/openapi-ts.md) — 3.5M weekly downloads
- [@mapbox/geojson-rewind](https://npm.io/package/@mapbox/geojson-rewind.md) — 2.4M weekly downloads
- [turbo-stream](https://npm.io/package/turbo-stream.md) — 1.7M weekly downloads

## Recent versions

- 1.0.1 (latest) — 2019-08-03
- 1.0.0 — 2019-08-03

## README

# EthOTP
![Build Status](https://travis-ci.org/insightsan/EthOTP.svg?branch=master)

EthOTP is a Node.js implementation of Ethereum One-Time Password (EthOTP) Authentication.
It provides a costless mechanism of securely determining Ethereum address ownerships off-chain for any Ethereum network
without transmission of the private key.

This module is to be used as middleware for conventional web authentication implementations such as session or token
based authentication.

## Authentication Workflow
 * Client requests a challenge-string from server
 * Server uses EthOTP to generate a challenge-string and send it to the client (whilst storing the challenge-string)
 * The client signs the challenge-string with their private key (via MetaMask/hardware wallet/whatever) and sends it
 back
 * Server receives the signed challenge-string and verifies (signature matching challenge-string) and
  validates (check that challenge-string is generated by EthOTP and not time expired) the challenge-string
 * Server then has proof of ownership of the address, and can then continue to authenticate the client via JWT or
 something else

## Potential Use Cases
* Message board where users are not allowed to post unless they have a certain amount of ETH or token
* Removing username/password authentication requirements (sign in using address only, then linking that to accounts)

## Usage

### Generating a challenge
```
let challengeString = ethotp.generateChallenge();
```

### Verifying a signed response
```
let isVerifiedAndValid = ethotp.validateAndVerify(message, signature, address);
```
isVerifiedAndValid is a boolean value representing whether the message was signed with the signature and that the
address is the signer of the message

### Installation
```npm install ethotp```

### Running tests
```npm test```

# Vulnerabilities / Issue reporting
If you find any vulnerabilities please let me know [on github as an issue](https://github.com/insightsan/EthOTP/)
thanks ٩( ''ω'' )و

---
_Source: https://npm.io/package/ethotp · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._