How to design an OTP service with a mobile app and integrate it into an existing website?

To design an OTP service with a mobile application and integrate it into an existing website, several key aspects need to be considered:

1. Generation and Storage of OTP: OTPs should be unique, one-time, and have a limited validity period (e.g., 5 minutes). Fast in-memory databases like Redis with TTL can be used for storage.

2. Security: OTPs should be transmitted over secure channels (HTTPS) and stored in encrypted form or not stored at all if algorithmic generation is used (e.g., TOTP).

3. Mobile Application: Implement an interface in the mobile app for entering OTP and interacting with the server via API. Push notifications or SMS can be used to deliver OTP.

4. Website Integration: Add a mechanism on the website to request OTP (e.g., during login or action confirmation). The website should send requests to the OTP service server and verify the entered code.

5. API for Interaction: Create a RESTful API with methods for generating, sending, and verifying OTP.

6. Logging and Monitoring: Keep logs of OTP generation and verification attempts to detect suspicious activity.

Example of a simplified API in Go for generating and verifying OTP:

var otpStore = make(map[string]string) // userID -> OTP

func generateOTP(userID string) string {
    otp := fmt.Sprintf("%06d", rand.Intn(1000000))
    otpStore[userID] = otp
    go func() {
        time.Sleep(5 * time.Minute)
        delete(otpStore, userID)
    }()
    return otp
}

func verifyOTP(userID, otp string) bool {
    if val, ok := otpStore[userID]; ok && val == otp {
        delete(otpStore, userID)
        return true
    }
    return false
}

In a real system, Redis with TTL should be used instead of a map, and OTP delivery via SMS or push notifications should be ensured.