[Feature]:

[chandankoranga02]

Feature Description

Currently Opscord has not OTP email verification options.
Add email OTP verification functionality during user registration and login to improve account authenticity and security. Users should receive a One-Time Password (OTP) on their email address, which must be verified before account activation or sensitive actions.

Problem It Solves

Currently, users can register using fake or invalid email addresses. This can lead to:

• Spam or bot account creation
• Fake user registrations
• Difficulty in password recovery
• Reduced trust and security in the platform

Email verification ensures that the user owns the provided email address and improves overall authentication reliability.

Proposed Solution

Backend Flow

1. User submits registration form with email and password.

2. Backend generates a secure random OTP (e.g., 6 digits).

3. OTP is stored temporarily in the database with:

   • Email
   • OTP
   • Expiration time
   • Verification status

4. OTP is sent to the user's email using an email service provider such as:

   • Nodemailer + Gmail SMTP
   • SendGrid
   • Resend
   • Mailtrap (for testing)

5. User enters the OTP on the verification page.

6. Backend validates:

   • Correct OTP
   • Expiry time
   • Associated email

7. If valid:

   • User account is marked as verified
   • JWT/session authentication continues

8. Add resend OTP functionality with rate limiting to prevent abuse.

Suggested Tech Stack

• Node.js + Express
• MongoDB / PostgreSQL
• Nodemailer or Resend API
• Redis (optional for temporary OTP storage)

Security Considerations

• Hash OTP before storing (recommended)
• Set OTP expiration (5–10 minutes)
• Add rate limiting for resend attempts
• Prevent brute-force verification attempts

Alternatives Considered

Verification Link Instead of OTP

Instead of entering an OTP manually, users can click an email verification link.

Pros

• Better user experience
• Faster verification flow

Cons

• Less suitable for mobile-first OTP workflows
• Requires token generation and verification routes

Third-Party Authentication

Use Google OAuth or social login instead of manual email verification.

Pros

• Faster signup
• Reduced password management

Cons

• Depends on external providers
• Not all users prefer social login

Difficulty Estimate

• 🟢 Easy (good first issue)
• 🟡 Medium
• 🔴 Hard

[github-actions]

👋 This issue has been automatically marked as stale because it has had no activity for 7 days. It will be closed in 3 days if no further activity occurs.
If you're still working on this, please comment to keep it open.

[chandankoranga02]

@probably-ABHINAV please give any update regards this .