kms

# One-time-code factor

`one_time_code` is the built-in development/test factor provider.

It generates a high-entropy one-time code and returns that code in the session challenge response.

## Why this is not production MFA

If the same remote caller receives the challenge and the code, the code is not an independent second factor. It only proves the caller can read the KMS API response.

Use `one_time_code` for:

- local development;
- tests;
- demos;
- building a custom provider prototype.

Do not use `one_time_code` as production MFA for remote users.

## Challenge shape

A pending session challenge includes the code:

```elixir
%{
  provider: "one_time_code",
  factor_id: "...",
  label: "email",
  code: "..."
}
```

The caller advances with that code:

```elixir
{:ok, session} = KMS.advance_session(pending.secret, %{code: challenge.code})
```

## Production alternatives

Use one of:

- [`totp`](totp.md) for authenticator-app MFA;
- a custom provider that sends codes out of band by email, SMS, push, or another trusted channel;
- WebAuthn/passkeys outside KMS when phishing-resistant MFA is required.

Custom production providers should return challenge metadata only and must not return secret codes in API responses.