Locking Down the Outpost: Building a Zero-Password, Single-User OTP Login

The terminal screen glowed in the dark room, casting a faint hue across the desk. The UI was ready: INITIALIZE NEW LOG, TRANSMISSION CONTENT. It felt like the control panel of a deep-space frequency transmitter. But a beautiful interface is a vulnerable target if the back door is left wide open.

I didn't need a massive user database. I didn’t need complex role-based access control, Google OAuth, or a bloated registration flow. This was my digital outpost. Population: One.

I just needed to make sure that when someone tried to initialize a new log, it was actually me sitting at the keys.

Here is how I built a hyper-focused, zero-password, single-user authentication system using nothing but an environment variable, an email transporter, and a single-use OTP strategy that leaves brute-force scripts hitting a brick wall.

The Blueprint: Trusting the Environment

Most authentication tutorials start with npm i bcrypt and a user schema. I skipped all of that. If there’s only one person who should ever see the dashboard, why store their identity in a database table?

Instead, I locked the target identity into the bedrock of the server itself:

env [email protected] JWT_SECRET=super_secret_transmission_key

By hardcoding the allowed email into the environment variables (process.env.ADMIN_EMAIL), I eliminated an entire class of database-lookup vulnerabilities. There are no users to enumerate. There is only the Environment, and it knows exactly who the captain is.

Step 1: Triggering the Transmission

When I navigate to the login page and type in my email, the backend triggers a silent protocol.