We are using TOTP for email-based OTP verification, where the OTP is generated server-side, sent via email, and typically entered by the user within ~2 minutes.
Verification code:
var keyBytes = Base32Encoding.ToBytes(otpKey);
var totp = new Totp(keyBytes, step: 120);
var isValid = totp.VerifyTotp(otpCode, out var timeStepMatched, VerificationWindow.RfcSpecifiedNetworkDelay);
return isValid;
We observe that verification works when the OTP is entered immediately, but often returns false when the same correct OTP is entered after a short delay (sometimes well under 2 minutes).
We expected the OTP to remain valid for approximately the full 120 seconds from the moment it is generated, but this does not seem to be the case. We would appreciate clarification on whether this usage pattern is supported or if a different approach is recommended.
We are using TOTP for email-based OTP verification, where the OTP is generated server-side, sent via email, and typically entered by the user within ~2 minutes.
Verification code:
We observe that verification works when the OTP is entered immediately, but often returns false when the same correct OTP is entered after a short delay (sometimes well under 2 minutes).
We expected the OTP to remain valid for approximately the full 120 seconds from the moment it is generated, but this does not seem to be the case. We would appreciate clarification on whether this usage pattern is supported or if a different approach is recommended.