title: How to set the expiry time of an OTP sent via SMS using ASP.NET Core Identity in .Net 5?
body: <p>I have done authentication in my project using Identity scaffolding. My project is using .Net 5 Razor Pages with Identity authentication.<br>I generated the identity files by scaffolding identity. And I am using out of the box &quot;<strong>LoginWith2fa.cshtml</strong>&quot;(we get this page from identity scaffolding) to send OTP to the user via SMS. Everything is working fine but how do I set the expiry time of that OTP.</p>
  <p>I remember in the Asp.net framework, there was an option in &quot;Startup.Auth.cs&quot; file to set the expiry time like this:</p>
  <pre><code>app.UseTwoFactorSignInCookie(DefaultAuthenticationTypes.TwoFactorCookie, TimeSpan.FromMinutes(5));
  </code></pre>
  <p>I checked these links but want to know the equivalent code in .net core.<br>
  <a href="https://stackoverflow.com/questions/38082902/what-is-max-expiry-for-asp-net-identity-two-factor-code">What is max expiry for ASP.NET Identity Two Factor code?</a> <br>
  <a href="https://stackoverflow.com/questions/28087302/asp-net-identity-2-two-factor-security-code-timespan">ASP.Net Identity 2, Two Factor Security Code timespan</a> <br><br>
  Is there any equivalent in ASP.NET Core Identity? How do I set the expiry time of an OTP?</p>
  <p>Here is how my &quot;LoginWith2fa.cshtml.cs&quot; page looks like: <br></p>
  <pre><code>    [AllowAnonymous]
      public class LoginWith2faModel : PageModel
      {
          private readonly SignInManager&lt;IdentityUser&gt; _signInManager;
          private readonly UserManager&lt;IdentityUser&gt; _userManager;
          private readonly ILogger&lt;LoginWith2faModel&gt; _logger;
  
          public LoginWith2faModel(SignInManager&lt;IdentityUser&gt; signInManager,
              ILogger&lt;LoginWith2faModel&gt; logger,
              UserManager&lt;IdentityUser&gt; userManager)
          {
              _signInManager = signInManager;
              _logger = logger;
              _userManager = userManager;
          }
  
          [BindProperty]
          public InputModel Input { get; set; }
          public bool RememberMe { get; set; }
          public string ReturnUrl { get; set; }
  
          public class InputModel
          {
              [Required]
              [StringLength(7, ErrorMessage = &quot;The {0} must be at least {2} and at max {1} characters long.&quot;, MinimumLength = 6)]
              [DataType(DataType.Text)]
              [Display(Name = &quot;Authenticator code&quot;)]
              public string TwoFactorCode { get; set; }
  
              [Display(Name = &quot;Remember this machine&quot;)]
              public bool RememberMachine { get; set; }
          }
  
          public async Task&lt;IActionResult&gt; OnGetAsync(bool rememberMe, string returnUrl = null)
          {
              IdentityUser user = await _signInManager.GetTwoFactorAuthenticationUserAsync();
              if (user == null)
              {
                  throw new InvalidOperationException($&quot;Unable to load two-factor authentication user.&quot;);      
              }
  
              string token = await _userManager.GenerateTwoFactorTokenAsync(user, &quot;Phone&quot;);
              // SendSMS();
  
              ReturnUrl = returnUrl;
              RememberMe = rememberMe;
              return Page();
          }
  
          public async Task&lt;IActionResult&gt; OnPostAsync(bool rememberMe, string returnUrl = null)
          {
              if (!ModelState.IsValid)
              {
                  return Page();
              }
  
              returnUrl ??= Url.Content(&quot;~/&quot;);
              var user = await _signInManager.GetTwoFactorAuthenticationUserAsync();
              if (user == null)
              {
                  throw new InvalidOperationException($&quot;Unable to load two-factor authentication user.&quot;);
              }
  
              string authenticatorCode = Input.TwoFactorCode.Replace(&quot; &quot;, string.Empty).Replace(&quot;-&quot;, string.Empty);
              var result = await _signInManager.TwoFactorSignInAsync(&quot;Email&quot;, authenticatorCode, rememberMe, Input.RememberMachine);
              if (result.Succeeded)
              {
                  _logger.LogInformation(&quot;User with ID '{UserId}' logged in with 2fa.&quot;, user.Id);
                  return LocalRedirect(returnUrl);
              }
              else if (result.IsLockedOut)
              {
                  _logger.LogWarning(&quot;User with ID '{UserId}' account locked out.&quot;, user.Id);
                  return RedirectToPage(&quot;./Lockout&quot;);
              }
              else
              {
                  _logger.LogWarning(&quot;Invalid authenticator code entered for user with ID '{UserId}'.&quot;, user.Id);
                  ModelState.AddModelError(&quot;OTPErrorMessage&quot;, &quot;Invalid OTP.&quot;);
                  return Page();
              }
          }        
      }
  </code></pre>
  <p>Can anybody help me on this?</p>