- (totp-verify SECRET CODE #!key (time (current-seconds)) (period 30) (t0 0) (digits 6) (algorithm 'sha1) (window 1)) -> fixnum or #fprocedure
Verifies CODE against the time step at time and, symmetrically, against the window steps immediately before and after it (RFC 6238 section 5.2's recommended clock-drift tolerance). Returns the matched step offset (an exact integer between (- window) and window, inclusive; 0 means an exact match at the current step) on success, or #f otherwise.
This procedure does not itself guard against replay: since a TOTP code remains valid for the whole period-second step it belongs to (and longer still under a nonzero window), an application must track, per secret, the absolute step of the last code it accepted and refuse any future match at or before that step. See totp-time-step below and the stateful-verify.scm example.