Build a Secure OTP Authentication System with ASP.NET Core (.NET 10)

In modern applications, passwordless authentication is becoming the preferred choice for both security and user experience. In this blog, we’ll walk through a complete OTP-based authentication system built with ASP.NET Core (.NET 10) that supports both traditional password login and email-based OTP login, powered by ASP.NET Core Identity and JWT tokens.
This implementation is production-ready, scalable, and follows industry best practices.

Overview

This authentication system enables users to log in securely using a One-Time Password (OTP) sent to their email. It also keeps traditional email/password login for backward compatibility. Key Highlights

• 6-digit OTP generation
• 10-minute OTP expiry
• One-time use (prevents replay attacks)
• JWT-based authentication (60-minute session)
• Role-based authorization support
• Secure HTML email templates

Supported Login Methods

• Email + Password
• Email + OTP (Passwordless Login)

Architecture & Authentication Flow

Send OTP Flow

1. User submits email
2. System validates the user
3. Generates a random 6-digit OTP
4. Stores OTP with expiry time in database
5. Sends OTP via email
6. Returns success response