oath_hotp_validate(3)

✨ NAME ✨

oath_hotp_validate — API function. Yep, that’s the whole name bestie, and this page lives under the manual name liboath 🫶💖.

🌸 SYNOPSIS 🌸

#include <oath.h>

int oath_hotp_validate(const char * secret, size_t secret_length,
       uint64_t start_moving_factor, size_t window, const char * otp);

🎀 ARGUMENTS 🎀

• const char * secret — the shared secret string 🔐
• size_t secret_length — length of secret 📏
• uint64_t start_moving_factor — start counter in OTP stream 🔢
• size_t window — how many OTPs after start counter to test 🪟
• const char * otp — the OTP to validate. ✅

💖 DESCRIPTION 💖

Okay so this function validates an OTP according to the OATH HOTP algorithm per RFC 4226. Literally the main character of this whole page ✨.

Currently only OTP lengths of 6, 7 or 8 digits are supported. This restrictions may be lifted in future versions, although some limitations are inherent in the protocol — so yeah, some protocol limits are just built different 💀.

🔥 RETURNS 🔥

It returns position in OTP window (zero is first position), or OATH_INVALID_OTP if no OTP was found in OTP window, or an error code. That’s the return-value tea ☕👑

🐛 REPORTING BUGS 🐛

Report bugs to <oath-toolkit-help@nongnu.org> 📬.

• liboath home page: https://oath-toolkit.codeberg.page/
• General help using GNU software: http://www.gnu.org/gethelp/

👑 COPYRIGHT 👑

Copyright © 2009-2026 Simon Josefsson.

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.

---

Signing off with liboath 2.6.15 — that’s the footer’s source/version flex, and there’s no date in the footer, just vibes 🫶💜🎀