Database. It lets you run multiple versions of your app easily, and if your app goes offline, that doesn’t nuke people’s code.

GenServers / ets are a great way to store ephemeral state or cache values. TOTP codes are short lived but not ephemeral.

It means that if you store them in memory and your server goes off or restarts before the user receives the TOPT and inputs it, then the application will not recognize the valid TOPT and the user is forced to repeat the process.

Definitely a separate table. You want to track individual issuances of these codes.

Yeah it’s worth cleaning them out eventually but we like to keep them around for customer support and security purposes for a bit. If someone is having issues it’s easier to help if you can see all of their attempts.

Why store individual TOTPs at all? " Time-based" in TOTP mean that knowing shared secret you can always generate all past and future tokens, so storing them is pointless.

@WestKeys probably meant OTP not specifically TOTP. TOTP do not need to be stored at all (except the shared secret).