gapido-grpc-auth/docs/adr/002-redis-otp-state.md

ADR 002: Store OTP State In Redis

Status

Accepted.

Context

OTP state is temporary, security-sensitive, and must expire automatically.

Decision

Store only HMAC hashes of OTP codes in Redis, with TTLs, attempt counters, and request rate limits.

Consequences

OTP verification is fast and self-expiring. Plaintext OTPs are not persisted. The local debug provider writes a separate development-only key for demos.