# ADR 002: Store OTP State In Redis

## Status

Accepted.

## Context

OTP state is temporary, security-sensitive, and must expire automatically.

## Decision

Store only HMAC hashes of OTP codes in Redis, with TTLs, attempt counters, and request rate limits.

## Consequences

OTP verification is fast and self-expiring. Plaintext OTPs are not persisted. The local debug provider writes a separate development-only key for demos.